IP Library › Granted Patent US 12683977
Granted Patent B2
US 12683977 · App. 18/817,521 · Granted Jul 14, 2026

Systems and methods for identifying security requirements in a ZTNA system

Inventor: Robert A. May (Burnaby, CA)
Assignee: Fortinet, Inc.
H04L63/108
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12683977
App. No.
18/817,521
Granted
Jul 14, 2026
Kind
B2
Abstract

Various embodiments provide systems and methods for providing security in a ZTNA system.

Claims (36)

1 . A method comprising:

maintaining, by a network security appliance controlling access to a local network, (i) a list of initiating applications authorized to access the local network and (ii) a list of endpoint devices authorized to access the local network;

receiving, by the network security appliance, a zero trust network access (ZTNA) request from an endpoint device;

extracting, by the network security appliance from the ZTNA request, an endpoint device identification identifying the endpoint device and an initiating application identification identifying a network access application executing on the endpoint device;

based on the list of initiating applications, the list of endpoint devices, the endpoint device identification, and the initiating application identification, selectively allowing or blocking, by the network security appliance, establishment of a ZTNA connection to the endpoint device; and

removing, by the network security appliance, a particular initiating application from the list of initiating applications based on identification of an application vulnerability associated with the particular initiating application.

2 . The method of claim 1 , wherein the network access application comprises an Internet browser, a transmission control protocol (TCP) forwarding application, or a remote desktop client.

3 . The method of claim 1 , wherein the initiating application identification includes information indicative of both the network access application and a version of the network access application.

4 . The method of claim 1 , wherein the ZTNA connection comprises a ZTNA tunnel.

5 . The method of claim 1 , wherein the endpoint device identification uniquely identifies the endpoint device.

6 . A system comprising:

one or more processing resources;

a non-transitory computer readable medium coupled to the one or more processing resources and having stored therein instructions that when executed by the one or more processing resources, cause the system to:

maintain (i) a list of initiating applications authorized to access a local network to which access is controlled by the system and (ii) a list of endpoint devices authorized to access the local network;

receive a zero trust network access (ZTNA) request from an endpoint device;

extract from the ZTNA request an endpoint device identification identifying the endpoint device and an initiating application identification identifying a network access application executing on the endpoint device;

based on the list of initiating applications, the list of endpoint devices, the endpoint device identification, and the initiating application identification, selectively establish or block establishment of a ZTNA connection to the endpoint device; and

when establishment of the ZTNA connection to the endpoint device has been blocked, communicate a message to the endpoint device indicating a reason for blocking establishment of the ZTNA connection to the endpoint device.

7 . The system of claim 6 , wherein the network access application comprises an Internet browser, a transmission control protocol (TCP) forwarding application, or a remote desktop client.

8 . The system of claim 6 , wherein the initiating application identification includes information indicative of both the network access application and a version of the network access application.

9 . The system of claim 6 , wherein the ZTNA connection comprises a ZTNA tunnel.

10 . The system of claim 6 , wherein the endpoint device identification uniquely identifies the endpoint device.

11 . The system of claim 6 , wherein the instructions further cause the system to remove a particular initiating application from the list of initiating applications based on identification of an application vulnerability associated with the particular initiating application.

12 . A non-transitory computer readable medium having stored therein instructions that when executed by one or more processing resources of a network security appliance cause the network security appliance to:

maintain (i) a list of initiating applications authorized to access a local network to which access is controlled by the network security appliance and (ii) a list of endpoint devices authorized to access the local network;

receive a zero trust network access (ZTNA) request from an endpoint device;

extract from the ZTNA request an endpoint device identification identifying the endpoint device and an initiating application identification identifying a network access application executing on the endpoint device;

based on the list of initiating applications, the list of endpoint devices, the endpoint device identification, and the initiating application identification, selectively establish or block establishment of a ZTNA connection to the endpoint device; and

removing, by the network security appliance, a particular initiating application from the list of initiating applications based on identification of an application vulnerability associated with the particular initiating application.

13 . The non-transitory computer readable medium of claim 12 , wherein the network access application comprises an Internet browser, a transmission control protocol (TCP) forwarding application, or a remote desktop client.

14 . The non-transitory computer readable medium of claim 12 , wherein the initiating application identification includes information indicative of both the network access application and a version of the network access application.

15 . The non-transitory computer readable medium of claim 12 , wherein the endpoint device identification uniquely identifies the endpoint device.

16 . The non-transitory computer readable medium of claim 12 , wherein the instructions further cause the network security appliance to remove a particular initiating application from the list of initiating applications based on identification of an application vulnerability associated with the particular initiating application.

17 . The non-transitory computer readable medium of claim 12 , wherein the instructions further cause the network security appliance to, when establishment of the ZTNA connection to the endpoint device has been blocked, communicate a message to the endpoint device indicating a reason for blocking establishment of the ZTNA connection to the endpoint device.

18 . The non-transitory computer readable medium of claim 12 , wherein the network security appliance is provided as a service in a cloud.

19 . The method of claim 1 , further comprising when establishment of the ZTNA connection to the endpoint device is blocked, communicating, by the network security appliance, a message to the endpoint device indicating a reason for blocking establishment of the ZTNA connection to the endpoint device.