Patent ID: 11968269
Assignee: NETSKOPE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A multi-tenant cloud native control plane system for providing network connections between a plurality of gateway endpoints using tags and secure tunnels, the multi-tenant cloud native control plane system comprises:
an end-user device including a client endpoint, the client endpoint is configured to provide a request for establishing a network connection between the client endpoint and a service endpoint of the plurality of gateway endpoints in a network;
a cloud control plane coupled to the end-user device; and
a cloud provider configured to provide data on the service endpoint corresponding to the request, wherein the cloud control plane is configured to:
receive the request for establishing the network connection;
identify a tenant associated with the request and isolate the tenant from a plurality of tenants;
identify zones associated with the request, wherein the zones include locations of the client endpoint and service endpoint;
assign a tag to each gateway endpoint in the network based on a tag policy, wherein the tag policy is based on the zones, tenant specific rules, a user location, the network connection, or a priority associated with the plurality of gateway endpoints, and the tag policy specifies connectivity between the tags;
identify the connectivity of the tags of the plurality of gateway endpoints from network traffic of devices corresponding to the plurality of gateway endpoints;
identify the tags corresponding to the tenant associated with the request;
identify patterns from the connectivity of the tags, wherein the patterns include connections between the devices, the gateway endpoints, user locations or device addresses;
specify a plurality of tunnels between the tags based on the patterns and the connectivity of the tags;
generate a database of devices with corresponding device addresses, wherein the devices are associated with the corresponding gateway endpoints in the network;
exchange the database of devices between the plurality of gateway endpoints using a protocol to determine routes between the plurality of gateway endpoints;
determine a secure tunnel from the plurality of tunnels based on the tags corresponding to the tenant; and
establish the network connection between the client endpoint and the service endpoint via the secure tunnel using the routes between the plurality of gateway endpoints.