# US 12,003,512 B2 · Limiting discovery of a protected resource in a zero trust access model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,512 B2 - Document ID: US12003512B2 - Status: Granted - Kind: B2 - Application number: 17/506,956 - Filed: 2021-10-21 - Published: 2023-04-27 - Granted: 2024-06-04 - Earliest claimed: 2021-10-21 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Sharif Mufid-Sharif Anani; Omar Abduljaber; Christopher Carl Cassell; Marc Neuberger; David Steven Gross; Luis Daniel Mendez - Web page: https://patentgrep.com/patent/US12003512B2 ## CPC - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/0281: {Proxies} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to an embodiment, a system comprises one or more processors and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations. The operations comprise determining that an endpoint device has requested to discover a location of a protected resource that is protected by a gateway, determining whether the endpoint device has provided a token that is valid, and permitting the endpoint device to discover the location of the protected resource based on determining that the endpoint device has provided the token that is valid. The token indicates that the endpoint device successfully completed a first multi-factor authentication procedure in connection with accessing an authentication enforcement resource. ## Claims ### Claim 1 A system, the system comprising: one or more processors; and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising: determining that an endpoint device has requested to discover a location of a protected resource, the protected resource protected by a gateway; providing the endpoint device with a token based on the endpoint device successfully completing a first multi-factor authentication procedure, wherein the first multi-factor authentication procedure comprises authenticating a first authentication factor and a second authentication factor, the second authentication factor based on performing a real-time verification of a user of the endpoint device; receiving the token from the endpoint device; determining whether the token provided by the endpoint device is valid, the token indicating that the endpoint device successfully completed the first multi-factor authentication procedure in connection with accessing an authentication enforcement resource; and permitting the endpoint device to discover the location of the protected resource based on determining that the endpoint device has provided the token that is valid. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations further comprise: after permitting the endpoint device to discover the location of the protected resource, determining that the endpoint device has requested to access the protected resource; determining whether the endpoint device successfully completed a second multi-factor authentication procedure in connection with accessing the protected resource, the second multi-factor authentication procedure involving the gateway; and permitting the endpoint device to access the protected resource based on determining that the endpoint device successfully completed the second multi-factor authentication procedure. ### Claim 3 (depends on 1) The system of claim 1, wherein the first authentication factor is based on verifying a login credential of the user of the endpoint device. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise: providing the endpoint device with the token based on the endpoint device successfully completing the first multi-factor authentication procedure in connection with accessing any authentication enforcement resource of a plurality of authentication enforcement resources available to the user of the endpoint device, regardless of whether the accessed authentication enforcement resource is related to the protected resource. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations further comprise: determining that the endpoint device has requested to discover a location of a second protected resource, the second protected resource protected by the gateway; determining that the token provided by the endpoint device has become invalid; facilitating a token refresh with the endpoint device; and permitting the endpoint device to discover the location of the second protected resource after the token refresh. ### Claim 6 (depends on 1) The system of claim 1, wherein permitting the endpoint device to discover the location of the protected resource comprises communicating a resource-relay mapping to the endpoint device. ### Claim 7 (depends on 1) The system of claim 1, wherein the system provides a Zero Trust access model that requires the endpoint device to establish a minimum level of trust in order for the endpoint device to discover the location of the protected resource. ### Claim 8 (depends on 1) The system of claim 1, wherein the endpoint device is permitted to discover the location of the protected resource without requiring the endpoint device to establish a secure tunnel with the gateway. ### Claim 9 (depends on 1) The system of claim 1, wherein the first multi-factor authentication procedure is performed independently of the gateway. ### Claim 10 A method, the method comprising: determining that an endpoint device has requested to discover a location of a protected resource, the protected resource protected by a gateway; providing the endpoint device with a token based on the endpoint device successfully completing a first multi-factor authentication procedure, wherein the first multi-factor authentication procedure comprises authenticating a first authentication factor and a second authentication factor, the second authentication factor based on performing a real-time verification of a user of the endpoint device; receiving the token from the endpoint device; determining whether the token provided by the endpoint device is valid, the token indicating that the endpoint device successfully completed the first multi-factor authentication procedure in connection with accessing an authentication enforcement resource; and permitting the endpoint device to discover the location of the protected resource based on determining that the endpoint device has provided the token that is valid. ### Claim 11 (depends on 10) The method of claim 10, further comprising: after permitting the endpoint device to discover the location of the protected resource, determining that the endpoint device has requested to access the protected resource; determining whether the endpoint device successfully completed a second multi-factor authentication procedure in connection with accessing the protected resource, the second multi-factor authentication procedure involving the gateway; and permitting the endpoint device to access the protected resource based on determining that the endpoint device successfully completed the second multi-factor authentication procedure. ### Claim 12 (depends on 10) The method of claim 10, wherein the first authentication factor based on verifying a login credential of the user of the endpoint device. ### Claim 13 (depends on 10) The method of claim 10, further comprising: providing the endpoint device with the token based on the endpoint device successfully completing the first multi-factor authentication procedure in connection with accessing any authentication enforcement resource of a plurality of authentication enforcement resources available to the user of the endpoint device, regardless of whether the accessed authentication enforcement resource is related to the protected resource. ### Claim 14 (depends on 10) The method of claim 10, further comprising: determining that an endpoint device has requested to discover a location of a second protected resource, the second protected resource protected by the gateway; determining that the token provided by the endpoint device has become invalid; facilitating a token refresh with the endpoint device; and permitting the endpoint device to discover the location of the second protected resource after the token refresh. ### Claim 15 One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause performance of operations comprising: determining that an endpoint device has requested to discover a location of a protected resource, the protected resource protected by a gateway; providing the endpoint device with a token based on the endpoint device successfully completing a first multi-factor authentication procedure, wherein the first multi-factor authentication procedure comprises authenticating a first authentication factor and a second authentication factor, the second authentication factor based on performing a real-time verification of a user of the endpoint device; receiving the token from the endpoint device; determining whether the token provided by the endpoint device is valid, the token indicating that the endpoint device successfully completed the first multi-factor authentication procedure in connection with accessing an authentication enforcement resource; and permitting the endpoint device to discover the location of the protected resource based on determining that the endpoint device has provided the token that is valid. ### Claim 16 (depends on 15) The one or more computer-readable non-transitory storage media of claim 15, wherein the operations further comprise: after permitting the endpoint device to discover the location of the protected resource, determining that the endpoint device has requested to access the protected resource; determining whether the endpoint device successfully completed a second multi-factor authentication procedure in connection with accessing the protected resource, the second multi-factor authentication procedure involving the gateway; and permitting the endpoint device to access the protected resource based on determining that the endpoint device successfully completed the second multi-factor authentication procedure. ### Claim 17 (depends on 15) The one or more computer-readable non-transitory storage media of claim 15, wherein the first authentication factor based on verifying a login credential of the user of the endpoint device. ### Claim 18 (depends on 15) The one or more computer-readable non-transitory storage media of claim 15, wherein the operations further comprise: providing the endpoint device with the token based on the endpoint device successfully completing the first multi-factor authentication procedure in connection with accessing any authentication enforcement resource of a plurality of authentication enforcement resources available to the user of the endpoint device, regardless of whether the accessed authentication enforcement resource is related to the protected resource. ### Claim 19 (depends on 15) The one or more computer-readable non-transitory storage media of claim 15, wherein the operations further comprise: determining that the endpoint device has requested to discover a location of a second protected resource, the second protected resource protected by the gateway; determining that the token provided by the endpoint device has become invalid; facilitating a token refresh with the endpoint device; and permitting the endpoint device to discover the location of the second protected resource after the token refresh. ### Claim 20 (depends on 15) The one or more computer-readable non-transitory storage media of claim 15, wherein permitting the endpoint device to discover the location of the protected resource comprises communicating a resource-relay mapping to the endpoint device.