1.3 Cloud Infrastructure: Central Authority, Edge & Nanolog

1.3 Cloud Infrastructure: Central Authority, Edge & Nanolog

Quick Answer: The Zscaler cloud is structured around a Tri-Plane Architecture that cleanly separates management, packet processing, and logging: the Control Plane (Central Authority), the Data Plane (Public & Private Service Edges), and the Logging Plane (Nanolog & NSS). Traffic is processed at the Edge using the patented Single-Scan Multi-Action (SSMA) engine, which performs all security, policy, and threat evaluations simultaneously in a single memory pass.

---

1. The Tri-Plane Cloud Architecture

Unlike traditional virtualized firewalls that stack legacy appliances in cloud virtual machines, Zscaler built a cloud-native, massively distributed multi-tenant platform spanning three distinct operational planes:

+-----------------------------------------------------------------------------+
|                   ZSCALER TRI-PLANE CLOUD ARCHITECTURE                      |
+-----------------------------------------------------------------------------+

    +---------------------------------------------------------------------+
    |                     1. CONTROL PLANE (CENTRAL AUTHORITY)            |
    |  * Web Admin Portal          * SAML/SCIM Identity Management        |
    |  * Global Policy DB Distribution * Cloud Health & Telemetry Probing  |
    +---------------------------------------------------------------------+
                         |                              |
        Real-time Delta  |                              | Policy Sync
        Policy Updates   v                              v
    +---------------------------------------------------------------------+
    |                     2. DATA PLANE (SERVICE EDGES)                   |
    |  * 150+ Global Public Service Edges  * Private Service Edges (On-Prem)|
    |  * Single-Scan Multi-Action (SSMA)   * SSL/TLS Proxy & Deep Decrypt |
    |  * Cloud Firewall, IPS, URL, DLP     * ZPA Public & Private Brokers |
    +---------------------------------------------------------------------+
                                        |
                       Real-time Stream | (Encrypted Metadata)
                                        v
    +---------------------------------------------------------------------+
    |                     3. LOGGING PLANE (NANOLOG CLUSTERS)             |
    |  * Patented 50:1 Lossless Compression * Real-time Global Indexing   |
    |  * Web & Firewall Insights Dashboards * Nanolog Streaming Service  |
    +---------------------------------------------------------------------+
                                        |
                                        v
                       +---------------------------------+
                       | Enterprise SIEM (Splunk/Sentinel|
                       +---------------------------------+

1. Control Plane: Central Authority (CA)

• The "Brain" of the Cloud: The Central Authority is hosted in redundant tier-1 data center facilities globally. It manages tenant configuration policies, administrator authentication, role-based access control (RBAC), and identity provider integrations.
• Delta Policy Push: When an administrator creates or modifies a policy rule (e.g., adding a URL block or modifying a DLP dictionary) and clicks Save and Activate, the CA compiles the policy into an optimized binary format and distributes the delta changes to all 150+ global Service Edge nodes in under 30 seconds.
• Zero Traffic Handling: The Central Authority never processes user data packets. If communication between an Edge node and the CA is temporarily disrupted, the Edge continues enforcing cached policies without interrupting user connectivity.

2. Data Plane: Public and Private Service Edges

• The "Enforcement Engine": Service Edges are high-capacity compute clusters deployed at major internet peering points and telecommunications exchange facilities worldwide.
• ZIA Public Service Edge (formerly ZEN - Zscaler Enforcement Node): Intercepts outbound web/internet traffic, terminates client TLS sessions, executes the Single-Scan Multi-Action engine, enforces security/access policies, and brokers connections to destinations.
• ZPA Public Service Broker: Facilitates zero trust connections between authenticated clients and App Connectors, creating end-to-end micro-tunnels without inspecting private application payloads.
• Private Service Edge (ZIA / ZPA): Dedicated virtual or hardware instances deployed inside customer data centers, remote manufacturing plants, or private cloud VPCs. They handle localized traffic processing for low-latency requirements or strict data residency mandates while remaining centrally orchestrated by the public CA.

3. Logging Plane: Nanolog & Nanolog Streaming Service (NSS)

• Patented High-Performance Log Engine: Processing over 500 billion transactions daily generates massive volumes of log data. The Nanolog architecture uses specialized, in-memory compression algorithms achieving up to 50:1 lossless compression.
• Separation of Logs and Payload: Nanolog records transaction metadata (timestamp, user identity, URL category, firewall action, threat signatures, bytes transferred) but never stores user payload data, preserving user privacy and compliance (GDPR, HIPAA).
• Nanolog Streaming Service (NSS): An on-premises or cloud-hosted virtual appliance that establishes an encrypted tunnel to the Nanolog cluster. NSS receives raw log streams in real time, translates them into standard syslog formats (CEF, JSON, LEEF), and streams them directly into enterprise SIEMs (Splunk, Microsoft Sentinel, IBM QRadar, Sumo Logic).

---

2. Scale, Anycast Routing & Global Distribution

The Zscaler Zero Trust Exchange is distributed across 150+ carrier-grade colocation facilities globally. Key infrastructure attributes include:

• BGP Anycast Routing: Every Public Service Edge advertises identical Anycast IP ranges. When a client initiates a connection, internet routing protocols (BGP) automatically direct the packet to the geographically and topologically nearest data center.
• Direct Peering: Zscaler maintains thousands of direct peering interconnects (IXPs) with major SaaS and cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce), providing single-digit millisecond latency.
• Automatic Failover & Sub-Clouds: If a specific data center undergoes maintenance or experiences an ISP outage, Anycast routing and ZCC health probes instantly fail over traffic to the next closest healthy Service Edge without administrative intervention.

---

3. The Single-Scan Multi-Action (SSMA) Engine

Traditional on-premises security stacks use a "service chaining" architecture where packets are routed sequentially through multiple discrete hardware appliances (Firewall -> IPS -> URL Filter -> Antivirus -> DLP). Each device decrypts, inspects, re-encrypts, and forwards the packet, introducing cumulative latency and hardware bottlenecks.

+-----------------------------------------------------------------------------+
|               LEGACY SERVICE CHAINING VS. ZSCALER SSMA                      |
+-----------------------------------------------------------------------------+

  Legacy Appliance Chaining (Cumulative Latency & Repeated Decryption):
  [Client] --> [Firewall] --> [IPS] --> [URL Filter] --> [DLP] --> [Target]
                 (Decrypt)    (Inspect)   (Inspect)     (Re-encrypt)
                 
  Zscaler Single-Scan Multi-Action (Concurrent In-Memory Processing):
  
                 +---------------------------------------------+
                 |         Single-Scan Multi-Action (SSMA)     |
                 |                                             |
                 |      +--> Cloud Firewall & IPS Engine       |
                 |      |                                      |
  [Client] ---> [RAM] --+--> URL Filtering & Cloud App CASB    | ---> [Target]
   (TLS Decrypt) |      |                                      |   (TLS Re-encrypt)
                 |      +--> Advanced Threat Protection (ATP)  |
                 |      |                                      |
                 |      +--> Data Loss Prevention (DLP)        |
                 |      |                                      |
                 |      +--> Cloud Sandbox Heuristic Engine    |
                 +---------------------------------------------+

How SSMA Operates in RAM:

1. Single Decryption Pass: The Public Service Edge decrypts the TLS packet once and places the plaintext payload into shared high-speed RAM buffers.
2. Parallel Security Processing: All policy and threat engines (Firewall, IPS, URL Category, ATP signatures, DLP dictionaries, Sandbox hashing) scan the in-memory data stream simultaneously in a single CPU cycle pass.
3. Consolidated Multi-Action Verdict: The engine aggregates verdicts from all components (e.g., URL allowed, DLP compliant, but ATP malware detected) and takes immediate action (e.g., Block & Log).
4. Single Re-encryption Pass: If allowed, the stream is re-encrypted once and transmitted to the destination server.

---

4. Architectural Summary Table