Patent Description:
The present disclosure relates generally to continuous monitoring and optimization of a network based on security insights to address a user-level application experience. More specifically, this disclosure relates to a secure access service edge (SASE) network optimization controller (NOC) (referred to herein as an SNOC) that leverages additional security performance metrics and network performance metrics provided by the SASE device to maintain a user experience application access while also maintaining security controls.

Users access applications and other services provided over a computing network. In some instances, the access of these applications and other services may suffer from variations in network and security performance of a user endpoint within the network. In one example, key performance indicators (KPIs) relate to and/or define these variations in network and security performance. For example, a user that may utilize a large corporate environment or leverage virtual private network (VPN) services to access computing resources at a corporate headquarters. These access channels may, for example, be conducted via cloud services over the Internet, via a software-defined networking in a wide area network (SD-WAN) connection from their homes or other locations, and a VPN-less solution on their hand-held devices, among other computer network communication channels or access modalities. Connection times, speeds, and quality of data transmission, among other KPIs may vary from user to user depending on factors surrounding the access modality(ies) used by the user endpoint. This situation may result in an unexpected and/or undesirable decrease in the quality of service (QoS) experienced by the user when interacting with the network and the applications.

Trusted applications bypass processes may be employed, where an administrator may bypass certain security functions such as deep packet inspection once performance of the system degrades beyond a defined threshold. This mechanism works well when applications are well known and are <NUM>% trusted in a central location. However, as systems and users become distrusted within an ever-increasing network environment size and complexity, the ability to trust various users and applications becomes an issue. Further, the work force throughout the world has changed to a remote work force, and each user may utilize their own modalities to consume services. In this context, networks are distributed and adapting to the increase in size and complexity of a remote work force where trust becomes an issue amongst users and applications.

In one example, a user may choose to access the applications and other services using a different access modality that provides more efficient network performance but provides a different level of security to the user endpoint. For example, the user may utilize a direct internet access (DIA) utilizing, for example, a domain name system security extensions (DNSSEC). While the DIA may provide relatively better network performance by reducing network latencies, increasing data packet transmissions, and providing a more reliable connection, among other advantages associated with the network performance, the user may be compromising network security. Thus, the ability to provide a consistent policy and user experience from a deterministic network may prove difficult. It may be difficult to balance user experience with appropriate security controls in a nondeterministic computing environment.

<CIT> describes a system and method for application security and performance assessment. Aspects of the disclosed technology relate to an end-to-end system and method for managing security and privacy risks associated with downloadable applications for devices, as well as for monitoring performance of downloadable applications. The disclosed system and method allows for curation of an application distribution channel in which an enterprise administrator can have top-down and/or bottom-up management of a network of <NUM> devices. The top-down functionality allows for curation of application based on risk and performance, while the bottom-up functionality allows for real-time removal of harmful items and/or over-the-air healing functionality.

An organization such as a corporation or an individual may access applications and/or services via a myriad of different access modalities. In doing so, network performance may degrade for the access modality a user is currently using. Further, in some instances, security may be compromised for one or more computing devices within a network before and/or after the user changes an access modality within the network.

A SASE may provide a number of different types of security performance metrics and network performance metrics to a NOC. The NOC may utilize the different types of security performance metrics and network performance metrics to configure policies that allow the user to obtain an optimized network performance while maintaining a level of security that may be required by a user computing device, the network, and application being accessed by the user computing device, and/or a service being utilized by the user computing device. As used herein, an example secure access service edge (SASE) network optimization controller (NOC) may be referred to as a SNOC.

Examples described herein provide a network optimization controller (NOC) including one or more processors, and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including obtaining, from a secure access service edge (SASE) device executing a security service, a first data set defining a security performance metric provided by the security service, and obtaining, from the SASE, a second data set defining a network performance metric associated with a network device. The operations further include defining a policy based at least in part on the first data set and the second data set, determining if the policy has been violated, and changing a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated. The first access modality and second access modality define different methods of access to the end host.

Defining the policy may include updating an existing policy based at least in part on the first data set and the second data set. Further, defining the policy may include determining if an application executed by the end host is on a whitelist, and based at least in part on the application being executed by the end host is on the whitelist, defining the policy to allow access to the second access modality where the second access modality has a different level of security risk relative to the first access modality. The operations further include communicating the policy to a second network device. The second network device may be configured to execute the policy.

The policy may define a time period to use the second access modality. The operations further include changing the first access modality to the second access modality may include utilizing the second access modality for the time period, and changing to the first access modality based at least in part on an expiration of the time period. The security performance metric provided by the security service includes a metric provided by a domain name system (DNS) layer security service, a secure web gateway (SWG) service, a firewall service, a cloud access security broker (CASB) service, an interactive threat intelligence service, and combinations thereof. Determining if the policy has been violated includes determining if the security performance metric violates a threshold. The network performance metric associated with a network device includes a data transfer rate, a communication latency, or a session duration. Determining if the policy has been violated includes determining if the network performance metric violates a threshold.

Examples described herein also provide a method includes obtaining, from a secure access service edge (SASE) device executing a security service, a first data set defining security performance metric provided by the security service, and obtaining, from the SASE, a second data set defining a network performance metric associated with a network device. The method may further include defining a policy based at least in part on the first data set and the second data set, determining if the policy has been violated, and changing a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated, the first access modality and second access modality defining different methods of access to the end host. Defining the policy includes updating an existing policy based at least in part on the first data set and the second data set.

Defining the policy includes determining if an application executed by the end host is on a whitelist. The method may further include, based at least in part on the application being executed by the end host is on the whitelist, defining the policy to allow access to the second access modality. The second access modality has a different level of security risk relative to the first access modality.

The method further includes communicating the policy to a second network device. The second network device is configured to execute the policy. The policy may define a time period to use the second access modality. Changing the first access modality to the second access modality includes utilizing the second access modality for the time period, and changing to the first access modality based at least in part on an expiration of the time period.

The security performance metric provided by the security service may include a metric provided by a domain name system (DNS) layer security service, a secure web gateway (SWG) service, a firewall service, a cloud access security broker (CASB) service, an interactive threat intelligence service, and combinations thereof. Determining if the policy has been violated includes determining if the security performance metric violates a threshold. The network performance metric associated with a network device includes a data transfer rate, a communication latency, or a session duration. Determining if the policy has been violated includes determining if the network performance metric violates a threshold.

Examples described herein also provide a non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations, including obtaining, from a secure access service edge (SASE) device executing a security service, a first data set defining security performance metric provided by the security service, and obtaining, from the SASE, a second data set defining a network performance metric associated with a network device. The operations may further include defining a policy based at least in part on the first data set and the second data set, determining if the policy has been violated, and changing a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated. The first access modality and second access modality define different methods of access to the end host.

Defining the policy includes updating an existing policy based at least in part on the first data set and the second data set. Further, defining the policy includes determining if an application executed by the end host is on a whitelist, and based at least in part on the application being executed by the end host is on the whitelist, defining the policy to allow access to the second access modality. The second access modality has a different level of security risk relative to the first access modality.

The operations further comprises communicating the policy to a second network device, the second network device being configured to execute the policy. The security performance metric provided by the security service may include a metric provided by a domain name system (DNS) layer security service, a secure web gateway (SWG) service, a firewall service, a cloud access security broker (CASB) service, an interactive threat intelligence service, and combinations thereof. Determining if the policy has been violated includes determining if the security performance metric violates a threshold. The network performance metric associated with a network device may include a data transfer rate, a communication latency, or a session duration. Determining if the policy has been violated includes determining if the network performance metric violates a threshold.

Additionally, the techniques described in this disclosure may be performed as a method and/or by a system having non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, performs the techniques described above.

Turning now to the figures, <FIG> illustrates a system-architecture diagram <NUM> of an example secure access service edge (SASE) network optimization controller (NOC) (herein referred to as a SNOC) <NUM>, according to an example of the principles described herein. A SASE <NUM> may include hardware and software that provide network security functions including, for example, a domain name system (DNS) layer security <NUM> service, a secure web gateway (SWG) <NUM> service, firewall <NUM> service, a cloud access security broker (CASB) <NUM> service, and an interactive threat intelligence (ITI) <NUM> service, among other network and security services. The SASE <NUM> may include capabilities provided by a WAN such as a software-defined networking in a wide area network (WAN) (SD-WAN) to support any dynamic secure access needs of an organization. In one example, the capabilities of a SASE <NUM> may be delivered as a service (aaS) and may be based upon the identity of the entity, real-time context, enterprise security/compliance policies and continuous assessment of risk/trust throughout the sessions. Identities of entities may be associated with people, groups of people (e.g., branch offices), devices, applications, services, Internet of Things (IoT) systems and/or edge computing locations, among other associations. The SASE <NUM> described herein includes client-optimized security edge and/or client-optimized security access functionalities to provide the optimization of a user experience through or via a SASE network. Using the network ecosystem of the SASE <NUM>, insights including network performance and security intelligence may be obtained to improve the execution of applications utilized by a user endpoint <NUM>.

In one example, the SASE <NUM> is the Umbrella™ network security product suite developed by Cisco®. The SASE <NUM> provides a myriad of different network and security intelligence data to the SNOC <NUM> as described in more detail herein. The security and network services provide by the SASE <NUM> may protect users, their respective user endpoints <NUM>, and other computing devices <NUM> from malware, botnets, phishing, targeted online attacks, and other security threats that may be encountered within and/or without the SASE <NUM> environment. The other computing devices <NUM> may include, for example, any private SD-WAN <NUM>, any corporate SD-WAN <NUM>, network devices <NUM> (e.g., laptop computing devices, desktop computing devices, mobile phones, smart phones, tablets, servers, routers, workstations, Internet-of-Things (IoT) devices, etc.), virtual private network (VPN) devices <NUM>, among a myriad of other computing devices communicatively coupled to the SASE <NUM>.

In one example, the SASE <NUM> may provide domain name system (DNS) layer security <NUM> services. DNS-layer security services <NUM> provided by the SASE <NUM> may include, for example, the ability to create and enforce security policies related to the execution of the devices behind the network perimeter. The SASE <NUM> may include any type of data-driven threat intelligence engine that automatically updates malware, botnet, and phishing domain and IP whitelists and blacklists enforced by the SASE <NUM>. The intelligence data may be sourced from DNS requests the SASE <NUM> receives, and border gateway protocol (BGP) routing tables that are managed by the SASE's <NUM> network operations center. In this manner, the DNS layer security <NUM> services allow for security policies to not only be created and executed for the user endpoint <NUM> and the other computing devices <NUM>, but also created and executed for the devices within the overall computing environment. Use of security intelligence provided by the DNS layer security <NUM> services reduces or eliminates the potential for malicious applications and/or content to be installed or introduced into the user endpoint <NUM> and other computing devices <NUM>. The security intelligence provided by the DNS layer security <NUM> services may be provided to the SNOC <NUM> for use in creating and executing the policies for the devices within communicatively coupled thereto.

Further, in one example, the SASE <NUM> may provide a secure web gateway (SWG) <NUM> service. The SWG <NUM> service provides, for example, safe internet access to users who do not use a corporate networks or virtual private networks (VPNs) to connect to remote data centers. A SWG <NUM> provides protection against online security threats by enforcing an enterprise's security policies and by filtering malicious Internet traffic. In one example, the malicious Internet traffic may be filtered in real-time. The SWG <NUM> provides uniform resource locator (URL) filtering, application controls for web applications, and the detection and filtering of malicious code. Further, the SWG <NUM> provides data leak prevention services. As to the real-time traffic inspection, the SWG <NUM> inspects web traffic in real-time, analyzing content against corporate policies and ensuring any content that is inappropriate or which contravenes enterprise policy is blocked. The SWG <NUM> may perform any type of file inspection to ensure that the content transmitted via the web traffic is appropriate. In one example, the SWG <NUM> may allow an administrator to enforce security policy templates off the shelf and also configure policies that are suited to the corporation's business model and/or compliance requirements. In this manner, the SWG <NUM> may interact with the SNOC <NUM> to create, modify, edit, remove, delete, and otherwise configure policies for execution within the SASE <NUM>. Further, the SWG <NUM> provides roaming users to authenticate seamlessly and to have the same security policies apply to their individual computing devices as if the computing devices were communicatively coupled to the corporation's network. The SWG <NUM>, in this manner, may also be used to protect the user endpoint <NUM> and other computing devices <NUM> as these devices access the Internet and as Internet-related policies are created and executed by the SWG <NUM>. As to data leak prevention, the SWG <NUM> reduces or eliminates corporate data from being leaked to or stolen by a third party by detecting business terms such as payment card industry (PCI) number patterns and phrases or personally identifiable information. Any security intelligence provided by the SWG <NUM> may be provided to the SNOC <NUM> for use in creating and executing the policies for the devices communicatively coupled to the SASE <NUM>.

In one example, the SASE <NUM> may also provide a firewall <NUM> service. The firewall <NUM> service monitors and controls incoming and outgoing network traffic based on a number of predetermined security rules and establishes a barrier between a trusted internal network and untrusted external network, such as the Internet. In this manner, the firewall <NUM> ser may interact with the SNOC <NUM> to execute policies configured at least in part by the SNOC <NUM> within the SASE <NUM>. The security services provided by the firewall <NUM> may be provided to the user endpoint <NUM> and other computing devices <NUM>. Specifically, security intelligence provided by the firewall <NUM> may be provided to the SNOC <NUM> for use in creating and executing the policies within the SASE <NUM> for the user endpoint <NUM> and other computing devices <NUM>.

Further, in one example, the SASE <NUM> may also include a cloud access security broker (CASB) <NUM> service. A CASB <NUM> may be any on-premises or cloud-based software that sits between cloud service users and cloud applications and monitors all activity and enforces security policies. The CASB provides a number of services such as monitoring user activity, warning administrators about potentially hazardous actions, enforcing security policy compliance, and automatically preventing malware, among other activity. The CASB <NUM> may deliver security by preventing high-risk events and/or management by monitoring and mitigating the high-risk events. In one example, the CASB <NUM> may utilize application program interfaces (APIs), performance probes, telemetry, and other programming to inspect data and activity in the cloud to alert of risky events after the fact. Further, the CASB <NUM> may inspect firewall or proxy logs for usage of cloud applications. The same functions provided by the CASB <NUM> in relation to the SASE <NUM> may similarly applied to the user endpoint <NUM> and other computing devices <NUM>. Specifically, security intelligence provided by the CASB <NUM> may be provided to the SNOC <NUM> for use in creating and executing the policies for the devices communicatively coupled to the SASE <NUM>.

The SASE <NUM>, in one example, may also include an interactive threat intelligence (ITI) <NUM> service. The ITI <NUM> service provides intelligence associated with the relationships and evolution of internet domains, IPs, and files to assist in pinpointing attackers' infrastructures and predict future threats. Similarly, to the examples described above, the same functions provided by the ITI <NUM> in relation to the SASE <NUM> may similarly applied to the user endpoint <NUM> and other computing devices <NUM>. Specifically, security intelligence provided by the ITI <NUM> may be provided to the SNOC <NUM> for use in creating and executing the policies for the devices communicatively coupled to the SASE <NUM>.

The intelligence provided by the SASE <NUM> may be provided to the SNOC <NUM> to create and execute policies based on the intelligence obtained in connection with the SASE <NUM> and computing devices communicating via the SASE <NUM>. In one example, data defining intelligence from at least one security service executed by the SASE including the DNS layer security <NUM> services, a SWG <NUM> services, a firewall <NUM> services, CASB <NUM> services, an ITI <NUM> services, and combinations thereof may be utilized to by the SNOC <NUM> in configuring a number of policies.

In the examples described herein, the SNOC <NUM> service provided via the SASE <NUM> may be offered as one of the security services in the SASE <NUM>. In one example, an enterprise may subscribe to the services provided by the SNOC <NUM> for managing a user experience within the SASE <NUM> by dynamically and autonomously adjusting with the policies that further the security and functionality of the user endpoint <NUM> and/or other computing devices <NUM>. Management of the user experience within the SASE <NUM> includes utilization of differentiated and relational access modalities <NUM> to allow the SASE <NUM> to handle a myriad of network and security parameters and/or key performance indicators (KPIs) as adjustable or configurable parameters in to der to optimize user performance.

The SNOC <NUM> may be any network optimization controller (NOC) that resides on or is intricately executed with the SASE <NUM>. A NOC may be any combination of hardware and software that functions as a controller. Thus, the SNOC <NUM> may function to control any policy-related activities including, for example, policy creation, modification, editing, removal, deletion, and otherwise altering policies for execution within the SASE <NUM>.

Further, the SNOC <NUM> may function to either directly or indirectly (e.g., via the policies) modify an access modality <NUM> of the user endpoint <NUM> and/or other computing devices <NUM>. As used in the present specification and in the appended claims, the term "access modality" or similar language is meant to be understood broadly as any communication channels and/or methods used by the user endpoint <NUM>, the other computing devices <NUM>, or any other devices associated with the SASE <NUM> to access applications and/or utilize services provided via a computing network. Examples of access modalities <NUM> include a direct internet access (DIA) utilizing, for example, a domain name system security extensions (DNSSEC), private and/or corporate virtual private networks (VPNs), a secure internet gateway (SIG), a secure web gateway (SWG), private and/or corporate SD-WANs of different types including a remote access VPN (RAVPN) and a site-to-site VPN (S2SVPN), an enterprise head-end network, cellular networks and associated devices, and a cloud network, among other access modalities <NUM> as described herein. The access modalities <NUM> may also utilize split tunneling where a user may access dissimilar security domains like a public network (e.g., the Internet) and a LAN or WAN at the same time, using the same or different network connections. As described in more detail herein, the SNOC <NUM> may configure a number of policies based on KPIs defining security performance metrics and network performance metrics provided by the SASE <NUM> along with the user endpoint <NUM> and/or other computing devices <NUM>. Further, the SNOC <NUM> provides access to the user endpoint <NUM> and/or other computing devices <NUM> via any communication path through a number of networks including cloud networks, etc..

Although depicted as an element of SASE <NUM>, the SNOC <NUM> may be located anywhere within the network system described and/or depicted herein. Further, the policy configurations <NUM> configured by the SNOC <NUM> may be transmitted to any device within the network system described herein and stored in those devices as the policies <NUM> including the various elements of the SASE <NUM> such as the devices associated with the DNS-layer security <NUM> service, the SWG <NUM> service, the firewall <NUM> service, the CASB <NUM> service, and the ITI <NUM> service, among other network and security services. Further, the policy configurations <NUM> configured by the SNOC <NUM> may be transmitted to the user endpoint <NUM>, the other computing devices <NUM>, and/or any other device coupled to the network system described herein and presented as policies <NUM>. The policies <NUM> are depicted in <FIG> may be copies of the policy configurations <NUM> produced by the SNOC <NUM>. In one example, the policies <NUM> may be updated continually or at regular intervals when the SNOC <NUM> creates new policies and/or updates existing policies. The new and/or updated policies <NUM> maybe pushed to the user endpoint <NUM>, the other computing devices <NUM>, and/or any other device coupled to the network system based at least in part on the new policies being created and/or updated by the SNOC <NUM>.

In one example, the SNOC <NUM> may receive a baseline access modality policy referred to herein as a baseline policy. The baseline policy may be preconfigured and executed by the SNOC <NUM>, the SASE <NUM>, and other devices described herein. Thus, without use of the security performance metrics and/or network performance metrics as described herein, the baseline policy may be instantiated within the systems described herein. The baseline policy may, at a later instances, be dynamically changed based on the security performance metrics and/or network performance metrics as described herein.

The user endpoint <NUM> may be any computing device that communicates back and forth with the SASE <NUM> in order to access applications and/or services. In one example, the user endpoint <NUM> may be a laptop computing devices, desktop computing devices, mobile phones, smart phones, tablets, servers, routers, workstations, Internet-of Things (IoT) devices, etc.), virtual private network (VPN) devices <NUM>, among a myriad of other computing devices communicatively coupled to the SASE <NUM>. The user endpoint <NUM> may include an endpoint security client <NUM> that functions to authenticate and configure routing and encrypt and transport data packets and other network traffic via one of the access modalities <NUM> (e.g., a private and/or corporate VPN, a DIA, a DNSSEC, a SIG, a SWG, a private and/or corporate SD-WAN, a RAVPN, a S2SVPN, an enterprise head-end network, cellular networks and associated devices, and a cloud network, among other access modalities <NUM> as described herein). In one example, the endpoint security client <NUM> may include the AnyConnect™ endpoint security client <NUM> developed and distributed by Cisco®. In one example, the user endpoint <NUM> may include the policies <NUM> obtained from the SNOC <NUM> as the SNOC <NUM> configures the policies and produces the policy configurations <NUM>.

Similarly, the other computing devices <NUM> may also include an endpoint security client <NUM> that functions to authenticate and configure routing and encrypt and transport data packets and other network traffic via one of the access modalities <NUM>. In one example, the other computing devices <NUM> may also include the policies <NUM> obtained from the SNOC <NUM> as the SNOC <NUM> configures the policies and produces the policy configurations <NUM>.

The SASE <NUM> and the SNOC <NUM> serve to provide a cross architecture controller (e.g., the SNOC <NUM>) that continuously monitors and optimizes network performance based on security insights received from a security suite (e.g., services provide by the SASE <NUM>) at a user level application experience. An integrated closed loop security and network telemetry automated solution is provided by the SASE <NUM> and the SNOC <NUM>. Further, the SASE <NUM> and the SNOC <NUM> provide the ability to maintain a user's experience with applications and services provided via the network including access to the application while maintaining security controls. The differentiated and relational access modalities <NUM> allow a user to deal with any network and security parameter or KPI as an adjustable or configurable parameter to optimize user performance. Still further, the SASE <NUM> and the SNOC <NUM> provide a converged network and agent/client-based solution with the ability to measure real time user-experience and subsequently adjusting network, security, and/or application polices to maintain a security and user experience level. Further, the network may be optimized based at least in part on performance or threat related re-routing or throttling of traffic using the policies created and/or updated by the SNOC <NUM>.

The SASE <NUM> and its SNOC <NUM> provide for a converged system where a plurality of network and security devices identify at least one KPI indicative of a performance value (e.g., a performance degradation in network or security). In one example, depending on a criticality of the application being accessed, a control signal may be sent to the user endpoint <NUM> and/or the other computing devices <NUM> to direct traffic over a different access modality <NUM> (e.g., connectivity method) and/or dynamically modify quality of service (QoS) settings on a secure SD-WAN overlay provided by the SASE <NUM> for a period of time such as in instances where there exist communication links that maybe unstable (e.g., satellite, cellular, or degraded internet communication links).

In order to exert control and optimize inbound traffic performance coming into the SASE <NUM>, areas within the system at which control points may be created may be identified. The SNOC <NUM> may identify these control points and create the control points within the network environment. One such control point may be created within the SASE <NUM> and/or the SNOC <NUM> itself. Further, a control point may be created at one or more of the he DNS-layer security <NUM> service, the SWG <NUM> service, the firewall <NUM> service, the CASB <NUM> service, and the ITI <NUM> service, among other network and security services provided by the SASE <NUM>. Further, in one example, control points may be created at a head end module within a cloud network where VPN, SDWAN connections of different types (RAVPN/S2SVPN), and other network architectures may be terminated, and traffic routing decisions may also be influenced by the SNOC <NUM>. Still further, a number of control points may be created at the client level of the network such as at the user endpoint <NUM> and/or the other computing devices <NUM> via supplications or security posture agents that are connecting to the SASE <NUM>.

In one example, the SNOC <NUM> executing on the SASE <NUM> may determine that a connection with the user endpoint <NUM>, for example, is running slow by looking at the SASE <NUM> elements (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) including firewall, proxy, and/or security elements. The SNOC <NUM> may determine, based on the collective analytics from different sources (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) that a VPN connection the user endpoint <NUM> is utilizing should be optimized for a particular user or network. Based on the anomaly detected, the SNOC <NUM> may determine that the user may need to optimize their connection. The SNOC <NUM> may apply a number of thresholds in making a determination as to when a network connection qualifies as under-performing and/or when to seek to make a correction to the performance including changing an access modality <NUM> and/or changing a security setting, among other changes to a current network or security performance metric as defined by the KPIs described herein. For example, the user endpoint <NUM> may be accessing the network over a first VPN headend in a first cloud network as a first access modality <NUM>. However, the SNOC <NUM> may determine that a first VPN cluster, or a second VPN cluster on a second cloud network might offer a network and/or security performance above a threshold and/or as required by the application being accessed by the user endpoint <NUM> as a second access modality <NUM>. The SNOC <NUM> may make such a determination based on a number of predetermined remediation steps when the performance issue is detected. The SNOC <NUM> may then cause the network traffic from the user endpoint <NUM> to be redirected through the second access modality (e.g., the first VPN cluster, or a second VPN cluster on a second cloud network) to ensure that the user utilizing the user endpoint <NUM> will benefit from relatively better network performance.

In one example, the functionality of the SNOC <NUM> extends to end hosts via their VPN supplicant (e.g., an entity at one end of a point-to-point LAN segment that is being authenticated by an authenticator that is attached to the other end of that link). As decisions are made at the SNOC <NUM> based on the network or security performance metric as defined by the KPIs described herein, the client devices which utilize a VPN supplicant may call in to action various access modalities <NUM> (e.g., modules and path selection choices). In one example, the modules and path selection choices may include a split-tunneling path selection or an endpoint security client <NUM> (e.g., the AnyConnect™ module selection) as described above.

In an example where split-tunneling is selected by the SNOC <NUM> as the module and path selection choice, the SNOC <NUM> may remotely manage split-tunnel policy by way of integrations for optimal traffic routing to either send traffic for a given application direct to the SASE <NUM> or allow traffic to egress via the client's local internet access via a tunnel bypass. The split-tunnel method may utilize statically defined policy based on domain name system (DNS) and fully qualified domain name (FQDN) information. Utilizing the SASE <NUM> and SNOC <NUM>, the split-tunnel policy may be dynamic based on the influence of the SNOC <NUM> for a time period. In one example, the SNOC <NUM> may cause the access modality <NUM> to revert to the original access modality <NUM> based at least in part on the expiration of the time period.

In an example where the endpoint security client <NUM> (e.g., the AnyConnect™ module selection) is used for selectin of the access modality <NUM>, the endpoint security client <NUM> may have the ability to instruct any given end host to connect using various modules, per application being accessed as defined by the policies <NUM> and as defined by the policy configurations <NUM> made by the SNOC <NUM>. For example, the user endpoint <NUM> acting as a client may use a direct VPN to a SIG cloud, a direct VPN to an on-premises VPN headend, or other access modality <NUM>, and local client proxy settings may be modified to direct traffic at a SWG for direct proxy access while utilizing the SASE <NUM> for access to other internet applications. In another example, remote access and reverse proxy capabilities via a multi-factor authentication (MFA) such as Duo™ two factor authentication method developed and distributed by Cisco® may be utilized. The endpoint security client <NUM>, when preloaded on the clients, may receive the benefit of the influence of the SNOC <NUM> by selecting the best access modality <NUM> for a given application and allowing for multiple access modalities <NUM> to be in use at the same time.

<FIG> is a system-architecture diagram <NUM> of the example SNOC <NUM> of <FIG> depicting application of policies configured by the SNOC <NUM>, according to an example of the principles described herein. With additional reference to <FIG>, the SNOC <NUM> acting as the controller of the SASE <NUM> computing architecture, may receive logs, telemetry data, and other forms of network and performance data from the SNOC <NUM>, the SASE <NUM>, and/or the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>. The SNOC <NUM>, utilizing the network and performance data may corelate and compare them with application policies defined within the policy configuration <NUM> and pushed to other computing devices as policies <NUM>. The policies <NUM> defined by the SNOC <NUM> act as rules by which the SASE <NUM> is caused to operate. The policies may be triggered or violated by one or more client policies depending on a connection modality. A first type of policy that may be triggered or violated includes performance-based policies where the SNOC <NUM> seeks to optimize the network performance within the network. The performance-based optimization may include client-based network optimization and may be based on security insights obtained from the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>. In one example, an application owner may set a number of thresholds and/or tolerance measurements that best fit and optimize client flow sessions as to the application. For example when a session duration through a firewall <NUM> is deemed longer than a threshold time period and/or lacks traffic to a degree below a data transfer threshold, the application policy may dynamically send an update to the client to stop using a first VPN as a first access modality <NUM>, and use, instead, as second a second access modality <NUM>. The second modality may include, for example, a second VPN, a utilization of a DIA, or use an alternative policy for a given period of time. The period of time allows for dynamic updates to the policies <NUM> to be made as well as to allow for dynamic changes to the access modality <NUM>. Being able to dynamically switch between access modalities <NUM> optimizes the client connections without compromising security. Thus, a goal of the SNOC <NUM> is to optimize traffic versus reducing security safety measures.

A second type of policy that may be triggered or violated includes security-based policies where the SNOC <NUM> seeks to optimize the security performance within the network. Security-based optimization may include client-based network steering and throttling based on security insights obtained from the SNOC <NUM>, the SASE <NUM>, and/or the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>. Client devices that trigger various security detection mechanisms may be subject to a reduced experience based on various risk factors. In some instances, a client device may exhibit malicious behavior. In these instances, the client device may be placed into a quarantine state and segregated from the network, a cloud, or any asset that is being accessed to ensure that data within those networks are not compromised. While segregating the client device from the network is a viable option to maintain security as to the maliciously-acting client device, the SNOC <NUM> provides a mechanism by which security may be increased to allow the maliciously-acting client device to continue to access the network and reduce the tolerances the client device experiences. This relaxing of security policies may be based on a risk level that does not completely segregate the client device in instances where an operational uptime may take precedence over complete isolation of the client device. A number of security performance metrics may be used by the SNOC <NUM> to determine a level of threat from devices communicatively coupled to the network. The security performance metrics may include, for example, threat feeds of a connection event in a cloud delivered firewall (CDFW), suspicious domains/uniform resource locators (URLs) in the proxy/DNS security services, large amounts of data transfer, malicious traffic patterns determined through pattern matching communication behavior, among a myriad of other security performance metrics. The security performance metrics may be fed into the SNOC <NUM> to configure a number of performance-based policies or a policy-based redirect on the client. For example, a client device may access the applications or services via a CDFW, and it may be determined that the destination IP address is a malicious IP address. In this example, the SNOC <NUM> may redirect the client device for further inspection on the traffic if it is determined to be communicating on port <NUM>/<NUM>; a port that is often classified as an open, security risk prone port. The SNOC <NUM> may identify that the client device is attempting to share a large amount of data based on the traffic pattern. A performance-based policy may be enacted to throttle down the client device traffic to still allow communication. However, the experience may be significantly reduced where operational uptime is preserved for other low overhead activities until it can be fully investigated and determined that the client device needs to be either allowed to do the data transfer or completely denied access. In this manner, the SNOC <NUM> may create policy configurations as to the applications and/or services the client device is utilizing to reduce a security risk while still maintaining at least a level of network performance.

In the examples described above, the SNOC <NUM> may configure a number of performance-based policies and a number of security-based polices to obtain the policy configurations <NUM>. The policy configurations may then be used to ensure that both performance and security of the client device is not entirely compromised and may do so in a dynamic manner such that the user of the client device (e.g., the user endpoint <NUM>, the other computing devices <NUM>, or any other devices associated with the SASE <NUM> may experience reasonable levels of network performance without compromising security. The use of the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM> assist the SNOC <NUM> in determining the best policy configuration <NUM> that may be created to address these network performance and security issues in a dynamic manner.

In one example, based at least in part on a trigger being identified, at least one of the policy configurations provided by the SNOC <NUM> to the SDWAN (acting as a control point) may be to dynamically adjust a QoS to prioritize the traffic or drop other unnecessary traffic. Execution of this policy as defined by the SNOC <NUM> provides an abstraction layer for SDWAN and leverages security insights to improve network connectivity to a critical application.

In one example, based at least in part on an initial inspection of web traffic traversing the cloud hosted proxy solution by the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>, there may be a temporary inspection of web traffic under suboptimal traffic conditions to determine if there are applications that are deemed business-critical to the user and/or an enterprise the user is affiliated with. In this example, the SNOC <NUM> may obtain from the security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) a whitelisting of those business-critical applications. The SNOC <NUM> may create a number of policies <NUM>, <NUM> to ultimately optimize traffic flow to a proxy device. This white list may be dynamically applied to a proxy auto-config (PAC) file. The PAC file defines how a web browser and other user agents may automatically choose the appropriate proxy server (access modality) for fetching a given URL. In one example, an agent-based client solution may be provided on the user endpoint <NUM> or a VPN headend device. In this manner, business-critical applications, which may be relatively more trusted, may be prioritized for by way of network performance over security by whitelisting the business-critical applications within the SNOC <NUM> and creating policies <NUM>, <NUM> based on the whitelist.

Turning again to <FIG>, and with continued reference to <FIG>, the control plane of the system-architecture diagram <NUM> is the vehicle for client devices and network elements to request and receive a number of policies related to network performance and security and application connectivity policies. In the examples described herein, the control plane is managed via the SNOC <NUM>. In one example, the SNOC <NUM> may be installed as a function in a SIG <NUM> or in a cloud provider environment. An administrator of an enterprise, for example, may configure the policies defining access modalities of the applications to align with enterprise's requirements and security policies. The policies <NUM> configured by the SNOC <NUM> dictate path selection (access modalities <NUM>) for various applications. In one example, the enterprise may manage the applications. In one example, the applications may be SaaS applications where the company is a cloud consumer of the application services provided by a third party. For example, a user who wants to access Application A <NUM> may be directed to use a VPN connection to the SIG <NUM>. In contrast, access to Application C <NUM> may be provided over a corporate VPN (e.g., an enterprise head-end <NUM>). The policy configuration <NUM> created by the SNOC <NUM> may be applied in a top-down process, and once a match between the network topology and the policy is found, no further processing may occur. At the end of the policy may be included an implicit rule used to tell the client device how to access applications that do not have a desired access modality (e.g., connection method), such as general internet browsing. In one example, the newly configured policy <NUM> may be sent to client devices and network elements for execution as policies <NUM> locally.

In one example, based at least in part on the client device (e.g., the user endpoint <NUM>, the other computing devices <NUM>, or any other devices associated with the SASE <NUM>) booting up, the endpoint security client <NUM> of the client device, for example, may be executed. The client device may initiate a request to the SNOC <NUM> to receive a number of policies <NUM> based on the policy configurations <NUM> of the SNOC <NUM>. The policies <NUM> may be pre-programed into the client device at a time when the client device is deployed or installed. The SNOC <NUM> may push down to the client device a number of policies that are previously configured for local execution at the client device. In this manner, the policies are shared throughout the network with any computing device. In one example, role-based access control (RBAC) defining a number of roles and privileges associated with the client device may be used to provide granular control or customized control as the administrator and/or enterprise deem necessary.

The pushing down of the policies <NUM> from the SNOC <NUM> to the client device results in the client device utilizing the policies <NUM> to direct network traffic among the various access modalities <NUM> based at least in part on the policies <NUM>. In one example, some of the network traffic may be transmitted over a VPN to an enterprise head-end <NUM>. In this example, the enterprise head-end <NUM> may provide access to a number of applications and/or services such as Application C <NUM> where Application C <NUM> is considered a relatively less risky application such that the SNOC <NUM> may allow such an access modality with the understanding that Application C <NUM> is a trusted application as designated by the enterprise.

In one example, some of the network traffic may be transmitted to a SWG <NUM>. In this example, the SWG <NUM> provides access to a number of applications and/or services including Application B <NUM>. In this example, the SWG <NUM> may include the SWG <NUM> of <FIG>, and may be directly influenced by the SNOC <NUM> by way of policy configurations <NUM> and the use of network performance metrics and/or security performance metrics obtained from the SWG <NUM>, <NUM>.

In one example, some of the network traffic may be transmitted over a VPN to a SIG <NUM>. The SIG <NUM> may provide access to a number of applications and/or services including, for example, Application A <NUM> as depicted in <FIG>.

In one example, some of the network traffic may be transmitted over a DIA with DNSSEC <NUM>. In this example, a user may choose to access the applications and other services using a different access modality that provides more efficient network performance but provides a different level of security to the user endpoint such as the DIA-DNSSEC <NUM>. While the DIA may provide relatively better network performance by reducing network latencies, increasing data packet transmissions, and providing a more reliable connection, among other advantages associated with the network performance, the user may be compromising network security. Further, as depicted in <FIG>, the DIA-DNSSEC <NUM> may provide access to a number of applications and/or services including a No-Policy Application <NUM>. Therefore, this access modality <NUM> may be closely monitored by the SNOC <NUM>, the SASE <NUM>, and/or the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM> to obtain network performance metrics as well as security performance metrics to ensure that a level of risk associated with the DIA does not exceed a threshold that may result in the selection of an alternative access modality <NUM> for at least a time period.

In one example, the network traffic may be transmitted using a plurality of any of the access modalities described herein. For example, the access modules and path selection choices may include a split-tunneling path selection or an endpoint security client <NUM> (e.g., the AnyConnect™ module selection) as described herein. Further, in one example, a number of backup transmission paths may be configured for failover purposes. In this example, the SNOC <NUM> may switch to a redundant or standby access modality <NUM> upon the failure or abnormal termination of a previously selected access modality <NUM>. Further, in the examples described herein, the access modalities may include access via or to a third-party cloud network, and a third-party network, among other remote and non-private applications and services provided to a user as a service (aaS).

In one example, if a client device does not include the endpoint security client <NUM>, a bootup sequence may occur on a router device or any edge device that supports the capabilities of the endpoint security client <NUM>. For example, an SD-WAN router may boot up. In response to the SD-WAN router booting up, the SD-WAN router may communicate a vBond which provides the SD-WAN router with specifics about the environment including the existence of the SNOC <NUM>. The SD-WAN router may receive connectivity information from the vBond and create a connection to the SNOC <NUM>. Further, the SD-WAN router may request the policy for internet destined applications, thus enhancing the DIA use-case for SD-WAN.

In one example, if the client device in the above SD-WAN router example does include the endpoint security client <NUM> with the application path control capability described herein, the policies <NUM> may be received from the SD-WAN router. In this example, if the client device located behind the SD-WAN router boots up and attempts to communicate with the SNOC <NUM> in order to download the policies <NUM>, the SD-WAN router may see the request and answer on behalf of the SNOC <NUM>. In this example, the SD-WAN router may respond with instructions in the form of, for example, an app→con table that instructs the client device to send all traffic to the SD-WAN router. In this manner, policy duplication issues may be avoided. If a client device is not behind an application path control capable element such as the SD-WAN router used in this example, then the client device may download the policies <NUM> to execute on the client locally from another intermediate device or directly from the SNOC <NUM>. If the client device is behind an application path control capable element (e.g., the SD-WAN router), then the client device may receive the policies <NUM> from that element which steers all traffic towards the element itself as illustrated in, for example, <FIG>.

The above example scenarios are binary in nature as the policies <NUM> are pre-programmed and executed. However, in one example, the concepts described herein may be expanded and made more dynamic using traffic analytics data, and based at least in part on the analytics data, the policies <NUM> may be altered dynamically. In this example, the SNOC <NUM> may be "tapped" into a cloud environment through a network metadata capture and analysis application. The network metadata capture and analysis application may include, for example, an application referred to as "mercury;" a Linux™-based application written in Python™ programming language and described at, for example, https://github. com/cisco/mercury. The network metadata capture and analysis application may receive the traffic analytics data from its connection or association to applications in the cloud. A number of virtual network interface cards (vNICs) included within the SNOC <NUM> may connect into virtual personal computers (vPCs) or virtual networks (vNETs) in the cloud provider environment, or in the application stack itself, in order to monitor network traffic flows and obtain data the traffic analytics data to determine network performance metrics and security performance metrics. As described herein, the network performance metrics and security performance metrics may be used by the SNOC <NUM> to dynamically configure any policies <NUM> including pre-programmed policies found within the client device. In one example where a SIG <NUM> is deployed within the cloud network as depicted in <FIG>, the SNOC <NUM> may include a mercury-enabled vNIC connected to both a SWG <NUM> and an application profile that is hosted in the cloud environment.

In one example, the SNOC <NUM>, the SASE <NUM>, and/or the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM> may benefit from the functionality of a security monitoring system <NUM>. The security monitoring system <NUM> may be communicatively coupled to the SNOC <NUM> directly or indirectly, or via a network such as a cloud network. In one example, the security monitoring system <NUM> may provide a number of playbook configuration and initiation processes where pre-built playbooks and user-generated playbooks may be executed to extract observable security issues, determine a verdict for the observable security issues, detect targets involved in the security issues, and/or take mitigation and/or preventative actions such as isolating the targets involved and blocking malicious domains, among other security tasks. The security monitoring system <NUM> may include aspects and functionalities of a security information and event management (SIEM) application, a secure operations center (SOC), and/or a security orchestration, automation, and response (SOAR) program. In one example, SNOC may interact with the security monitoring system <NUM> and/or initiate automated capabilities that assist the SNOC <NUM> in identifying security-related instances and orchestrate security responses in an autonomous manner. Further, in one example, the SNOC <NUM> may push policy configurations <NUM> to the security monitoring system <NUM> in the form of the policies <NUM> to allow the security monitoring system <NUM> to utilize the policies <NUM> in providing its security functions.

Although a client device is described above in connection with <FIG> as the device interacting with the network architecture, the client device may include the user endpoint <NUM>, any of the other computing devices <NUM>, and/or any computing device described herein or communicatively coupled to the network architecture and the SNOC <NUM>.

<FIG> is a component diagram <NUM> of example components of a SNOC <NUM>, according to an example of the principles described herein. As illustrated, the SNOC <NUM> may include one or more hardware processor(s) <NUM>, one or more devices, configured to execute one or more stored instructions. The processor(s) <NUM> may comprise one or more cores. Further, the SNOC <NUM> may include one or more network interfaces <NUM> configured to provide communications between the SNOC <NUM> and other devices, such as devices associated with the SASE <NUM>, the user endpoint <NUM>, the other computing devices <NUM>, devices associated with the DNS layer security <NUM> services, the SWG <NUM> services, the firewall <NUM> services, the CASB <NUM> services, and the ITI <NUM> services, devices associated with a cloud service, the SIG <NUM>, the SWG <NUM>, the DIA-DNSSEC <NUM>, the enterprise head-end <NUM>, and/or other systems or devices associated with the SNOC <NUM> and/or remote from the SNOC <NUM>. The network interfaces <NUM> may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), and so forth. For example, the network interfaces <NUM> may include devices compatible with the SASE <NUM>, the user endpoint <NUM>, the other computing devices <NUM>, devices associated with the DNS layer security <NUM> services, the SWG <NUM> services, the firewall <NUM> services, the CASB <NUM> services, and the ITI <NUM> services, devices associated with a cloud service, the SIG <NUM>, the SWG <NUM>, the DIA-DNSSEC <NUM>, the enterprise head-end <NUM>, and/or other systems or devices associated with the SNOC <NUM> and/or remote from the SNOC <NUM>.

The SNOC <NUM> may also include a user interface <NUM>. The user interface <NUM> may allow a user such as an administrator to interact with the SNOC <NUM> to instruct the SNOC <NUM> to perform its functions including, for example, engage in policy configurations <NUM>, execute and maintain policies <NUM> within a network environment, and push policies <NUM> to a number of associated computing devices, among other functions described herein.

The SNOC <NUM> may also include computer-readable media <NUM> that stores various executable components (e.g., software-based components, firmware-based components, etc.). In addition to various components discussed herein, the computer-readable media <NUM> may further store components to implement functionality described herein. While not illustrated, the computer-readable media <NUM> may store one or more operating systems utilized to control the operation of the one or more devices that comprise the SNOC <NUM>. According to one example, the operating system comprises the LINUX operating system. According to another example, the operating system(s) comprise the WINDOWS SERVER operating system from MICROSOFT Corporation of Redmond, Washington. According to further examples, the operating system(s) may comprise the UNIX operating system or one of its variants. It may be appreciated that other operating systems may also be utilized.

Additionally, the SNOC <NUM> may include a data store <NUM> which may comprise one, or multiple, repositories or other storage locations for persistently storing and managing collections of data such as databases, simple files, binary, and/or any other data. The data store <NUM> may include one or more storage locations that may be managed by one or more database management systems. The data store <NUM> may store, for example, performance data <NUM> defining network performance metrics and security performance metrics obtained from the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>, and other services that may be operated via the SASE <NUM>. Further, the data store <NUM> may store security data <NUM>. The security data <NUM> may include any data obtained by the SNOC <NUM> regarding the security of the devices communicatively coupled to the SNOC <NUM>. For example, the security data <NUM> may include whitelists, blacklists, and/or greylists of applications executed within the network environment of the SNOC <NUM>, a list of malware, botnet, and phishing domain and IP whitelists and blacklists, other data defining the security of the devices communicatively coupled to the SNOC <NUM>, and combinations thereof.

The data store <NUM> may also store policy data <NUM>. Policy data <NUM> may include any data defining past and/or currently configured and/or executed policies within the SNOC <NUM> including the policy configurations <NUM> and the policies <NUM> pushed to other computing devices within the network environment. In one example, the policies may be created by an enterprise utilizing the SNOC <NUM> and stored in the data store <NUM> of the SNOC <NUM> such that the SNOC <NUM> may apply them to the management of the computing devices within the network environment.

Still further, the policy data <NUM> stored within the data store <NUM> may include rules data <NUM> that support or define the policy data <NUM>. The rules data <NUM> may include the executable code to enforce the policies <NUM> within the network environment.

The computer-readable media <NUM> may store portions, or components, of a client experience application control service <NUM>. For instance, the client experience application control service <NUM> of the computer-readable media <NUM> may include a network optimization component <NUM> to, when executed by the processor(s) <NUM>, optimize the network performance of a client device such as the user endpoint <NUM> and/or other computing devices <NUM>. The network optimization component <NUM> may obtain information such as security and intelligence data from the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM> in executing the policies <NUM> on behalf of the client devices. Further, the network optimization component <NUM> may assist in determining when a different access modality <NUM> is to be implemented for the client device and/or function to implement the different access modality <NUM>.

The client experience application control service <NUM> may also include a security optimization component <NUM> to, when executed by the processor(s) <NUM>, obtain security intelligence data from the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM>, and other services including the security monitoring system <NUM> according to the techniques described herein. The security optimization component <NUM> may also collect security data associated with accessing and utilizing the devices described herein. Further, the security optimization component <NUM> may also collect security data whitelists, blacklists, and/or grey lists of applications executed within the network environment of the SNOC <NUM>, a list of malware, botnet, and phishing domain and IP whitelists and blacklists, other data defining the security of the devices communicatively coupled to the SNOC <NUM>, and combinations thereof. The security optimization component <NUM> may store the data collected in the performance data <NUM>, the security data <NUM> and/or the policy data <NUM> of the data store <NUM> as described herein.

The client experience application control service <NUM> may also include a modality selection component <NUM> to, when executed by the processor(s) <NUM>, select an alternative access modality <NUM> for a client device in response to at least one of the policies <NUM> being violated. The modality selection component <NUM>, when executed by the processor(s) <NUM>, may also determine when a time period has elapsed wherein an original access modality <NUM> is again utilized after switching to an alternate access modality <NUM>. In one example, the modality selection component <NUM> may be executed by the processor(s) <NUM> in response to security performance metrics and/or network performance metrics provided by the various security devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of the SASE <NUM> defining a state at which the access modality <NUM> utilized by the client device is to be switched based on the policy configurations <NUM> defined by the policy management component <NUM> of the SNOC <NUM>.

The client experience application control service <NUM> may also include the policy management component <NUM> to, when executed by the processor(s) <NUM>, configure a number of policies <NUM> based on the data collected by the network optimization component <NUM> and/or the security optimization component <NUM>. Further, the policy management component <NUM> may also, when executed by the processor(s) <NUM>, push the policies <NUM> down to a number of computing devices within the network environment including, for example, the user endpoint <NUM>, the other computing devices <NUM>, and/or other computing devices described herein. Still further, the policy management component <NUM> may also, when executed by the processor(s) <NUM>, stored the configured policies <NUM>, <NUM> in the data store <NUM> as the policy data <NUM>. Even still further, the policy management component <NUM> may also, when executed by the processor(s) <NUM>, execute the policies <NUM> in response to a violation of the policies <NUM>.

<FIG> illustrates a flow diagram <NUM> of an example method managing access modalities of a user endpoint <NUM> via the SNOC <NUM>, according to an example of the principles described herein. The method of <FIG> may include, at <NUM>, obtaining at the SNOC <NUM> and from the SASE <NUM> device executing at least one security service (e.g., the DNS layer security <NUM> services, the SWG <NUM> services, the firewall <NUM> services, the CASB <NUM> services, the ITI <NUM> services, and other services provided by the SASE <NUM> according to the techniques described herein), a first data set defining security performance metrics provided by the security service (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>). The SNOC <NUM> may utilize the security optimization component <NUM>, executed by the processor(s) <NUM>, to obtain the first data set defining the security performance metrics. At <NUM>, the method may include obtaining, from the SASE <NUM> device, executing the at least one security service (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>), a second data set defining a network performance metrics associated with a network device. The SNOC <NUM> may utilize the network optimization component <NUM>, executed by the processor(s) <NUM>, to obtain the second data set defining the network performance metrics.

At <NUM>, the method may include defining a policy <NUM>, <NUM> based at least in part on the first data set and the second data set. The SNOC <NUM> may create the policy configurations <NUM> as well as the policies <NUM> for the user endpoint <NUM> and other computing devices <NUM>. The SNOC <NUM> may utilize the policy management component <NUM> to, when executed by the processor(s) <NUM>, define the policies <NUM>, <NUM> at <NUM>. In one example, defining the policy may include updating an existing policy based at least in part on the first data set and the second data set. Further, in one example, defining the policy may include determining if an application executed by the end host is on a whitelist, and, based at least in part on the application being executed by the end host is on the whitelist, defining the policy to allow access to the second access modality <NUM>, the second access modality <NUM> having a different level of security risk relative to the first access modality. Access to the second access modality <NUM> may be provided based at least in part on the policy being violated as described herein in connection with <NUM>.

With the processor(s) <NUM> executing the policy management component <NUM>, the method may include determining if a policy <NUM> has been violated at <NUM>. Violation of the policy may be detected by the SNOC <NUM> and may include, for example, at least one of the network performance metrics and security performance metrics passing a threshold defined by the policy <NUM>.

In one example, the security performance metric provided by the security service includes a metric provided by the DNS layer security <NUM> service, the SWG <NUM> service, the firewall <NUM> service, the CASB <NUM> service, the ITI <NUM> service, and combinations thereof. Further, determining if the policy <NUM> has been violated at <NUM> includes determining if the security performance metric violates a threshold. Further, the network performance metric associated with a network device may include a data transfer rate, a communication latency, or a session duration, and determining if the policy has been violated at <NUM> includes determining if the network performance metric violates a threshold set regarding the network performance metric.

At <NUM>, the method may include changing a first access modality <NUM> provided for the network device to access an end host to a second access modality <NUM> based at least in part on the policy <NUM> being violated. The first access modality <NUM> and the second access modality <NUM> define different methods of access for or to the end host. In the method of <FIG>, the network devices may include, for example, the user endpoint <NUM>, the other computing devices <NUM>, or any other devices associated with the SASE <NUM> to access applications and/or utilize services provided via a computing network. Further, the end host may include any application and/or service and their associated hardware and network architecture that support the application and/or service.

In one example, the policy <NUM> may define a time period to use the second access modality <NUM>. In this example, changing the first access modality <NUM> to the second access modality <NUM> at <NUM> may include utilizing the second access modality <NUM> for the time period, and changing back to the first access modality <NUM> or another access modality <NUM> based at least in part on an expiration of the time period.

The method of <FIG> provides for the functionality of a cross architecture controller (e.g., the SNOC <NUM>) that continuously monitors and optimizes network performance based on security insights received from a security suite (e.g., services provide by the SASE <NUM>) at a user level application experience. An integrated closed loop security and network telemetry automated solution is provided by the SASE <NUM> and the SNOC <NUM> executing the method of <FIG>. Further, with the SASE <NUM> and the SNOC <NUM>, the method of <FIG> provides the ability to maintain a user's experience with applications and services provided via the network including access to the application while maintaining security controls. The differentiated and relational access modalities <NUM> allow a user to deal with any network and security parameter or KPI as an adjustable or configurable parameter to optimize user performance. Still further, the method of <FIG>, utilizing the functionality of the SASE <NUM> and the SNOC <NUM>, provides a converged network and agent/client-based solution with the ability to measure real time user-experience and subsequently adjusting network, security, and/or application polices to maintain a security and user experience level. Further, the network may be optimized based at least in part on performance or threat related re-routing or throttling of traffic using the policies created and/or updated by the SNOC <NUM>.

<FIG> illustrates a flow diagram <NUM> of an example method for managing access modalities of a user endpoint <NUM> via the SNOC <NUM>, according to an example of the principles described herein. The method of <FIG> may include, at <NUM>, obtaining a first data set defining security performance metrics provided by the security service (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) as described above in connection with <FIG> at <NUM>. Similarly, at <NUM>, the method may include obtaining a second data set defining a network performance metric associated with a network device as described above in connection with <FIG> at <NUM>. At <NUM>, the method may include defining a policy <NUM>, <NUM> based at least in part on the first data set and the second data set as described above in connection with <FIG> at <NUM>. Further, the method may include determining if a policy <NUM> has been violated at <NUM> and as described above in connection with <FIG> at <NUM>. At <NUM>, the method may include changing a first access modality <NUM> provided for the network device to access an end host to a second access modality <NUM> based at least in part on the policy <NUM> being violated as described above in connection with <FIG> at <NUM>. The first access modality <NUM> and the second access modality <NUM> define different methods of access for or to the end host. In the method of <FIG>, the network devices may include, for example, the user endpoint <NUM>, the other computing devices <NUM>, or any other devices associated with the SASE <NUM> to access applications and/or utilize services provided via a computing network. Further, the end host may include any application and/or service and their associated hardware and network architecture that support the application and/or service.

At <NUM>, the method may include communicating the policy to at least a second network device. In one example, the second network device may be configured to execute the policy. The policy management component <NUM>, executed by the processor(s) <NUM>, of the SNOC <NUM> may configure the policies based at least in part on the first data set defining security performance metrics and the second data set defining a network performance metrics provided by the security service (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) and push the policy configurations <NUM> to the user endpoint <NUM>, the other computing devices <NUM>, and/or any other device coupled to the network system. Further, at <NUM>, the policies may be pushed to these computing devices based at least in part on a new policy being created and/or an existing policy being updated by the SNOC <NUM>.

<FIG> a computing system diagram illustrating a configuration for a data center <NUM> that may be utilized to implement aspects of the technologies disclosed herein. The example data center <NUM> shown in <FIG> includes several server computers 602A-602F (which might be referred to herein singularly as "a server computer <NUM>" or in the plural as "the server computers <NUM>) for providing computing resources. In some examples, the resources and/or server computers <NUM> may include, or correspond to, any type of networked device described herein. Although described as servers, the server computers <NUM> may comprise any type of networked device, such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, endpoints, etc..

The server computers <NUM> may be standard tower, rack-mount, or blade server computers configured appropriately for providing computing resources. In some examples, the server computers <NUM> may provide computing resources <NUM> including data processing resources such as VM instances or hardware computing systems, database clusters, computing clusters, storage clusters, data storage resources, database resources, networking resources, virtual private networks (VPNs), and others. Some of the server computers <NUM> may also be configured to execute a resource manager <NUM> capable of instantiating and/or managing the computing resources. In the case of VM instances, for example, the resource manager <NUM> may be a hypervisor or another type of program configured to enable the execution of multiple VM instances on a single server computer <NUM>. Server computers <NUM> in the data center <NUM> may also be configured to provide network services and other types of services.

In the example data center <NUM> shown in <FIG>, an appropriate LAN <NUM> is also utilized to interconnect the server computers 602A-502F. It may be appreciated that the configuration and network topology described herein has been greatly simplified and that many more computing systems, software components, networks, and networking devices may be utilized to interconnect the various computing systems disclosed herein and to provide the functionality described above. Appropriate load balancing devices or other types of network infrastructure components may also be utilized for balancing a load between data centers <NUM>, between each of the server computers 602A-502F in each data center <NUM>, and, potentially, between computing resources in each of the server computers <NUM>. It may be appreciated that the configuration of the data center <NUM> described with reference to <FIG> is merely illustrative and that other implementations may be utilized.

In one example, the server computers <NUM> and or the computing resources <NUM> may each execute/host one or more tenant containers and/or virtual machines to perform techniques described herein.

In one example, the data center <NUM> may provide computing resources, like tenant containers, VM instances, VPN instances, and storage, on a permanent or an as-needed basis. Among other types of functionality, the computing resources provided by a cloud computing network may be utilized to implement the various services and techniques described above. The computing resources <NUM> provided by the cloud computing network may include various types of computing resources, such as data processing resources like tenant containers and VM instances, data storage resources, networking resources, data communication resources, network services, VPN instances, and the like.

Each type of computing resource <NUM> provided by the cloud computing network may be general-purpose or may be available in a number of specific configurations. For example, data processing resources may be available as physical computers or VM instances in a number of different configurations. The VM instances may be configured to execute applications, including web servers, application servers, media servers, database servers, some or all of the network services described above, and/or other types of programs. Data storage resources may include file storage devices, block storage devices, and the like. The cloud computing network may also be configured to provide other types of computing resources <NUM> not mentioned specifically herein.

The computing resources <NUM> provided by a cloud computing network may be enabled in one example by one or more data centers <NUM> (which might be referred to herein singularly as "a data center <NUM>" or in the plural as "the data centers <NUM>). The data centers <NUM> are facilities utilized to house and operate computer systems and associated components. The data centers <NUM> may include redundant and backup power, communications, cooling, and security systems. The data centers <NUM> may also be located in geographically disparate locations. One illustrative example for a data center <NUM> that may be utilized to implement the technologies disclosed herein is described herein with regard to, for example, <FIG>, <FIG>, and <FIG>.

<FIG> illustrates a computer architecture diagram showing an example computer hardware architecture <NUM> for implementing a computing device that may be utilized to implement aspects of the various technologies presented herein. The computer hardware architecture <NUM> shown in <FIG> illustrates the SNOC <NUM>, the SASE <NUM>, the DNS layer security <NUM> services, the SWG <NUM> services, the firewall <NUM> services, the CASB <NUM> services, and the ITI <NUM> services, and/or other systems or devices associated with the SASE <NUM> and/or the SNOC <NUM> and/or remote from the SASE <NUM> and/or SNOC <NUM>, the user endpoint <NUM>, the other computing device <NUM> including, for example, a private SD-WAN <NUM>, a corporate SD-WAN <NUM>, network devices <NUM>, a VPN devices <NUM>, a workstation, a desktop computer, a laptop, a tablet, a network appliance, an e-reader, a smartphone, a mobile phone, a server, a router, an Internet-of-Things (IoT) device, or other computing device, and may be utilized to execute any of the software components presented herein. The computer <NUM> may, in some examples, correspond to a network device (e.g., the SASE <NUM> and/or the SNOC <NUM> (and associated devices) described herein, and may comprise networked devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, etc..

The computer <NUM> includes a baseboard <NUM>, or "motherboard," which is a printed circuit board to which a multitude of components or devices may be connected by way of a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (CPUs) <NUM> operate in conjunction with a chipset <NUM>. The CPUs <NUM> may be standard programmable processors that perform arithmetic and logical operations necessary for the operation of the computer <NUM>.

These basic switching elements may be combined to create more complex logic circuits, including registers, adders-subtractors, arithmetic logic units, floating-point units, and the like.

The chipset <NUM> provides an interface between the CPUs <NUM> and the remainder of the components and devices on the baseboard <NUM>. The chipset <NUM> may provide an interface to a RAM <NUM>, used as the main memory in the computer <NUM>. The chipset <NUM> may further provide an interface to a computer-readable storage medium such as a read-only memory (ROM) <NUM> or non-volatile RAM (NVRAM) for storing basic routines that help to startup the computer <NUM> and to transfer information between the various components and devices. The ROM <NUM> or NVRAM may also store other software components necessary for the operation of the computer <NUM> in accordance with the configurations described herein.

The computer <NUM> may operate in a networked environment using logical connections to remote computing devices and computer systems through a network, such as the SASE <NUM>. The chipset <NUM> may include functionality for providing network connectivity through a Network Interface Controller (NIC) <NUM>, such as a gigabit Ethernet adapter. The NIC <NUM> is capable of connecting the computer <NUM> to other computing devices over the WSN <NUM>. It may be appreciated that multiple NICs <NUM> may be present in the computer <NUM>, connecting the computer to other types of networks and remote computer systems. In some examples, the NIC <NUM> may be configured to perform at least some of the techniques described herein, such as obtaining network and/or security performance metric(s), perform policy configuration based at least in part on the network and/or security performance metric(s), execution of the policies, adjustment of access modalities based at least in part on the policies, and/or other techniques described herein.

The computer <NUM> may be connected to a storage device <NUM> that provides non-volatile storage for the computer. The storage device <NUM> may store an operating system <NUM>, programs <NUM>, and data, which have been described in greater detail herein. The storage device <NUM> may be connected to the computer <NUM> through a storage controller <NUM> connected to the chipset <NUM>. The storage device <NUM> may consist of one or more physical storage units. The storage controller <NUM> may interface with the physical storage units through a serial attached SCSI (SAS) interface, a serial advanced technology attachment (SATA) interface, a fiber channel (FC) interface, or other type of interface for physically connecting and transferring data between computers and physical storage units.

The computer <NUM> may store data on the storage device <NUM> by transforming the physical state of the physical storage units to reflect the information being stored. The specific transformation of physical state may depend on various factors, in different examples of this description. Examples of such factors may include, but are not limited to, the technology used to implement the physical storage units, whether the storage device <NUM> is characterized as primary or secondary storage, and the like.

For example, the computer <NUM> may store information to the storage device <NUM> by issuing instructions through the storage controller <NUM> to alter the magnetic characteristics of a particular location within a magnetic disk drive unit, the reflective or refractive characteristics of a particular location in an optical storage unit, or the electrical characteristics of a particular capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of physical media are possible, with the foregoing examples provided only to facilitate this description. The computer <NUM> may further read information from the storage device <NUM> by detecting the physical states or characteristics of one or more particular locations within the physical storage units.

In addition to the storage device <NUM> described above, the computer <NUM> may have access to other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. It may be appreciated by those skilled in the art that computer-readable storage media is any available media that provides for the non-transitory storage of data and that may be accessed by the computer <NUM>. In some examples, the operations performed by the SNOC <NUM> and/or the SASE <NUM> and or any components included therein, may be supported by one or more devices similar to computer <NUM>. Stated otherwise, some or all of the operations performed by the SNOC <NUM> and/or the SASE <NUM>, and or any components included therein, may be performed by one or more computer devices operating in a cloud-based arrangement. By way of example, and not limitation, computer-readable storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media includes, but is not limited to, RAM, ROM, erasable programmable ROM (EPROM), electrically-erasable programmable ROM (EEPROM), flash memory or other solid-state memory technology, compact disc ROM (CD-ROM), digital versatile disk (DVD), high definition DVD (HD-DVD), BLU-RAY, or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that may be used to store the desired information in a non-transitory fashion.

As mentioned briefly above, the storage device <NUM> may store an operating system <NUM> utilized to control the operation of the computer <NUM>. According to one example, the operating system <NUM> comprises the LINUX operating system. According to another example, the operating system comprises the WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Washington. According to further examples, the operating system may comprise the UNIX operating system or one of its variants. It may be appreciated that other operating systems may also be utilized. The storage device <NUM> may store other system or application programs and data utilized by the computer <NUM>.

In one example, the storage device <NUM> or other computer-readable storage media is encoded with computer-executable instructions which, when loaded into the computer <NUM>, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the examples described herein. These computer-executable instructions transform the computer <NUM> by specifying how the CPUs <NUM> transition between states, as described above. According to one example, the computer <NUM> has access to computer-readable storage media storing computer-executable instructions which, when executed by the computer <NUM>, perform the various processes described above with regard to <FIG>. The computer <NUM> may also include computer-readable storage media having instructions stored thereupon for performing any of the other computer-implemented operations described herein.

The computer <NUM> may also include one or more input/output controllers <NUM> for receiving and processing input from a number of input devices, such as a keyboard, a mouse, a touchpad, a touch screen, an electronic stylus, or other type of input device. Similarly, an input/output controller <NUM> may provide output to a display, such as a computer monitor, a flat-panel display, a digital projector, a printer, or other type of output device. It will be appreciated that the computer <NUM> might not include all of the components shown in <FIG>, may include other components that are not explicitly shown in <FIG>, or might utilize an architecture completely different than that shown in <FIG>.

As described herein, the computer <NUM> may comprise one or more of the SNOC <NUM>, the SASE <NUM>, the DNS layer security <NUM> services, the SWG <NUM> services, the firewall <NUM> services, the CASB <NUM> services, and the ITI <NUM> services, and/or other systems or devices associated with the SASE <NUM> and/or the SNOC <NUM> and/or remote from the SASE <NUM> and/or SNOC <NUM>, the user endpoint <NUM>, the other computing device <NUM> including the private SD-WAN <NUM>, a corporate SD-WAN <NUM>, network devices <NUM>, a VPN devices <NUM>, a workstation, a desktop computer, a laptop, a tablet, a network appliance, an e-reader, a smartphone, a mobile phone, a server, a router, an Internet-of-Things (IoT) device, and/or other systems or devices associated with the SNOC <NUM> and/or remote from the SNOC <NUM>. The computer <NUM> may include one or more hardware processor(s) such as the CPUs <NUM> configured to execute one or more stored instructions. The CPUs <NUM> may comprise one or more cores. Further, the computer <NUM> may include one or more network interfaces configured to provide communications between the computer <NUM> and other devices, such as the communications described herein as being performed by the SNOC <NUM>, the SASE <NUM>, and other devices described herein. The network interfaces may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), and so forth. For example, the network interfaces may include devices compatible with Ethernet, Wi-Fi™, and so forth.

The programs <NUM> may comprise any type of programs or processes to perform the techniques described in this disclosure for a SNOC <NUM> which will be offered through the SASE <NUM> and provides services of the SNOC <NUM> in order to obtain network and/or security performance metric(s), perform policy configuration based at least in part on the network and/or security performance metric(s), execution of the policies, adjustment of access modalities based at least in part on the policies, and/or other techniques described herein. The programs <NUM> may enable the devices described herein to perform various operations.

In summary, a network optimization controller (NOC) performs operations including obtaining, from a secure access service edge (SASE) device executing a security service, a first data set defining a security performance metric provided by the security service, and obtaining, from the SASE, a second data set defining a network performance metric associated with a network device. The operations further include defining a policy based at least in part on the first data set and the second data set, determining if the policy has been violated, and changing a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated. The first access modality and the second access modality define different methods of access to the end host.

While the present systems and methods are described with respect to the specific examples, it is to be understood that the scope of the present systems and methods are not limited to these specific examples. Since other modifications and changes varied to fit particular operating requirements and environments will be apparent to those skilled in the art, the present systems and methods are not considered limited to the example chosen for purposes of disclosure.

Claim 1:
A network optimization controller (NOC) comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
obtaining (<NUM>), from a secure access service edge (SASE) device executing a security service, a first data set defining a security performance metric provided by the security service;
obtaining (<NUM>), from the SASE, a second data set defining a network performance metric associated with a network device;
defining (<NUM>) a policy based at least in part on the first data set and the second data set;
determining (<NUM>) if the policy has been violated; and
changing (<NUM>) a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated, the first access modality and the second access modality defining different methods of access to the end host, wherein the policy defines a time period to use the second access modality, and
wherein changing (<NUM>) the first access modality to the second access modality includes:
utilizing the second access modality for the time period; and
changing to the first access modality based at least in part on an expiration of the time period.