# US 2022/0045987 A1 · Localization at scale for a cloud-based security service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0045987 A1 - Document ID: US20220045987A1 - Status: Published application - Kind: A1 - Application number: 17/120,047 - Filed: 2020-12-11 - Published: 2022-02-10 - Earliest claimed: 2020-08-04 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Thomas Arthur Warburton; Shu Lin; Devendra Raut; Jialiang Li; Hao Long - Web page: https://patentgrep.com/patent/US20220045987A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 61/2528: {Translation at a proxy} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 61/5061: Pools of addresses - H04L 2101/668: Internet protocol [IP] address subnets - H04L 2101/69: using geographic information, e.g. room number - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for providing localization at scale for a cloud-based security service are disclosed. In some embodiments, a system/method/computer program product for providing localization at scale for a cloud-based security service includes receiving a connection request at a network gateway of a cloud-based security service; performing a source Network Address Translation (NAT) from a registered set of public IP addresses associated with a tenant; and providing secure access to a Software as a Service (SaaS) using the cloud-based security service. ## Claims ### Claim 1 A system comprising: a processor configured to: receive a connection request at a network gateway of a cloud-based security service; perform a source Network Address Translation (NAT) from a registered set of public IP addresses associated with a tenant, wherein an egress IP from the network gateway is associated with a region that corresponds to the region of a user that sent the connection request to facilitate an enhanced user experience of locality for the user of the SaaS; and provide secure access to a Software as a Service (SaaS) using the cloud-based security service, wherein the cloud-based security service maintains a set of IP address ranges for each of their supported regions to provide distinct public IP address pools for each customer of the cloud-based security service; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein a first customer configures a distinct security policy associated with the distinct public IP address pool associated with the first customer. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the cloud-based security service is provided using a public cloud service provider. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the cloud-based security service is provided using a plurality of public cloud service providers. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the cloud-based security service is provided using a public cloud service provider that provides high-speed network connectivity from each of the public cloud service provider's various regional cloud-based computing service data centers to one or more SaaS providers. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the network gateway enforces a security policy. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the network gateway comprises a virtual firewall. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the connection request is associated with a new session, and wherein the processor is further configured to: determine a zone associated with the new session. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the connection request is associated with a new session, and wherein the processor is further configured to: determine a zone associated with the new session based on a secure tunnel configuration associated with the connection request. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the connection request is associated with a new session, and wherein the processor is further configured to: determine a zone associated with the new session based on a domain associated with the connection request. ### Claim 11 A method of synchronizing a honey network configuration to reflect a target network environment, comprising: receiving a connection request at a network gateway of a cloud-based security service; performing a source Network Address Translation (NAT) from a registered set of public IP addresses associated with a tenant, wherein an egress IP from the network gateway is associated with a region that corresponds to the region of a user that sent the connection request to facilitate an enhanced user experience of locality for the user of the SaaS; and providing secure access to a Software as a Service (SaaS) using the cloud-based security service, wherein the cloud-based security service maintains a set of IP address ranges for each of their supported regions to provide distinct public IP address pools for each customer of the cloud-based security service. ### Claim 12 (depends on 11) The method of claim 11, wherein a first customer configures a distinct security policy associated with the distinct public IP address pool associated with the first customer. ### Claim 13 (depends on 11) The method of claim 11, wherein the cloud-based security service is provided using a public cloud service provider. ### Claim 14 (depends on 11) The method of claim 11, wherein the cloud-based security service is provided using a plurality of public cloud service providers. ### Claim 15 (depends on 11) The method of claim 11, wherein the cloud-based security service is provided using a public cloud service provider that provides high-speed network connectivity from each of the public cloud service provider's various regional cloud-based computing service data centers to one or more SaaS providers. ### Claim 16 A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving a connection request at a network gateway of a cloud-based security service; performing a source Network Address Translation (NAT) from a registered set of public IP addresses associated with a tenant, wherein an egress IP from the network gateway is associated with a region that corresponds to the region of a user that sent the connection request to facilitate an enhanced user experience of locality for the user of the SaaS; and providing secure access to a Software as a Service (SaaS) using the cloud-based security service, wherein the cloud-based security service maintains a set of IP address ranges for each of their supported regions to provide distinct public IP address pools for each customer of the cloud-based security service. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein a first customer configures a distinct security policy associated with the distinct public IP address pool associated with the first customer. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein the cloud-based security service is provided using a public cloud service provider. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the cloud-based security service is provided using a plurality of public cloud service providers. ### Claim 20 (depends on 16) The computer program product recited in claim 16, wherein the cloud-based security service is provided using a public cloud service provider that provides high-speed network connectivity from each of the public cloud service provider's various regional cloud-based computing service data centers to one or more SaaS providers.