# US 12,225,053 B2 · Method for implementing cloud-based security protocols for a user device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,053 B2 - Document ID: US12225053B2 - Status: Granted - Kind: B2 - Application number: 17/898,162 - Filed: 2022-08-29 - Published: 2024-02-29 - Granted: 2025-02-11 - Earliest claimed: 2022-08-29 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Robert Edgar Barton; Jerome Henry; Indermeet Gandhi - Web page: https://patentgrep.com/patent/US12225053B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for implementing security policies for a user device based on one or more user device parameters. When a user device joins a domain, the security policy agent determines one or more security policies for the user device based on one or more parameters of the user device. The user parameters may include the type of user device, a user group, an application to be used, etc. The security polies are sent to the user device. The user device generates a data packet having metadata indicating the one or more device parameters. The data packet is sent to a remote security service where security policies are implemented based on the metadata. ## Claims ### Claim 1 A method for implementing cloud-based security protocols for a user device, the method comprising: receiving, at a cloud-based service, group policy objects (GPOs) that indicate a plurality of security services for network flows based on one or more parameters associated with the network flows; receiving, at the cloud-based service, a data packet of a network flow sent from a user device; identifying metadata in the data packet that indicates the parameters associated with the network flow; and determining, that the parameters in the metadata of the packet correspond to a particular GPO that indicates security services of the plurality of security services that are to be applied to the network flow; and sending the network flow to the one or more security services. ### Claim 2 (depends on 1) The method of claim 1, wherein the GPOs are based on one or more of a user device, user group, or application. ### Claim 3 (depends on 1) The method of claim 1, wherein the security services comprise secure access service edge security. ### Claim 4 (depends on 1) The method of claim 1, wherein the GPOs are received by a user device and the cloud-based service is remote from the user device. ### Claim 5 (depends on 1) The method of claim 1, wherein the metadata indicative of the GPOs comprises one or more headers attached to the data packet. ### Claim 6 (depends on 1) The method as in claim 1, wherein the GPOs generated via one or more of Group Policy Object (GPO) or Mobile Device Management (MDM) policy. ### Claim 7 (depends on 5) The method as in claim 5, wherein the one or more headers can be removed when an associated security service has been applied. ### Claim 8 A computer system, comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receiving, at a cloud-based service, group policy objects (GPOs) that indicate a plurality of security services for network flows based on one or more parameters associated with the network flows; receiving, at the cloud-based service, a data packet of a network flow sent from a user device; identifying metadata in the data packet that indicates the parameters associated with the network flow; and determining, that the parameters in the metadata of the packet correspond to a particular GPO that indicates security services of the plurality of security services that are to be applied to the network flow; and sending the network flow to the one or more security services. ### Claim 9 (depends on 8) The computer system as in claim 8, wherein the GPOs are based on one or more of a user device, user group, or application. ### Claim 10 (depends on 8) The computer system as in claim 8, wherein the security services comprise secure access service edge security. ### Claim 11 (depends on 8) The computer system as in claim 8, wherein the GPOs are received by a user device and the cloud-based service is remote from the user device. ### Claim 12 (depends on 8) The computer system as in claim 8, wherein the metadata indicative of the GPOs comprises one or more headers attached to the data packet. ### Claim 13 (depends on 12) The computer system as in claim 12, wherein the one or more headers can be removed when an associated security service has been applied. ### Claim 14 (depends on 8) The computer system as in claim 8, wherein the GPOs generated via one or more of Group Policy Object (GPO) or Mobile Device Management (MDM) policy. ### Claim 15 A method performed by a controller on a user device, the method comprising: receiving, at a cloud-based service, group policy objects (GPOs) that indicate a plurality of security services for network flows based on one or more parameters associated with the network flows; receiving, at the cloud-based service, a data packet of a network flow sent from a user device; identifying metadata in the data packet that indicates the parameters associated with the network flow; and determining, that the parameters in the metadata of the packet correspond to a particular GPO that indicates security services of the plurality of security services that are to be applied to the network flow; and sending the network flow to the one or more security services. ### Claim 16 (depends on 15) The method as in claim 15, wherein the GPOs are based on one or more of a user device, user group, or application. ### Claim 17 (depends on 15) The method as in claim 15, wherein the security services comprise secure access service edge security. ### Claim 18 (depends on 15) The method as in claim 15, wherein the metadata indicative of the GPOs comprises one or more headers attached to the data packet. ### Claim 19 (depends on 1) The method of claim 1, wherein the metadata indicates a set of tags that each correspond to individual ones of the plurality of security services, further comprising iteratively removing each tag of the set of tags as an associated security service has been applied to the network flow. ### Claim 20 (depends on 1) The method of claim 1, further comprising: joining, by the user device, a domain; receiving, at the user device, an indication of the security services of the plurality of security services that are to be applied to network flows from the user device and based at least in part on the domain; and populating, by the user device, the data packet of the network flow with the metadata.