# US 12,015,592 B2 · Zero trust approach to secure sensitive mobile applications and prevent distributed denial of service attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,592 B2 - Document ID: US12015592B2 - Status: Granted - Kind: B2 - Application number: 17/399,632 - Filed: 2021-08-11 - Published: 2021-12-02 - Granted: 2024-06-18 - Earliest claimed: 2016-05-18 - Assignees: Zscaler, Inc. - Applicants: Zscaler, Inc. - Inventors: Dhawal Kumar Sharma; John A. Chanak - Web page: https://patentgrep.com/patent/US12015592B2 ## CPC - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1021: based on client or server locations - H04L 61/2514: between local and global IP addresses - H04L 61/256: NAT traversal - H04L 61/4511: using domain name system [DNS] - H04L 61/59: using proxies for addressing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for protecting sensitive mobile applications from attack include incorporating private application access software in a mobile application that operates on a user device to provide functionality to an end user, the functionality is separate from the private application access; deploying application connectors in front of a private application that is accessed by the mobile application; responsive to a request to access the private application, authenticating the end user through the mobile application; and, responsive to authentication, providing access to the private application through the mobile application via a plurality of secure tunnels. The application connectors are configured to only provide outbound connections, thereby protecting the private application from the attack. The request to access is received via a cloud-based system which is configured to drop any invalid request, thereby protecting the private application from the attack. ## Claims ### Claim 1 A method of protecting sensitive applications that are accessed from a user's device from an attack, the method comprising: incorporating private application access software in a mobile application that operates on a user device to provide functionality to an end user, the private application access software enabling traffic associated with the mobile application to be forwarded to a cloud-based system; deploying one or more virtual lightweight application connector instances in front of a private application that is accessed by the mobile application; responsive to a request to access the private application, authenticating the end user through the mobile application; responsive to the authentication, providing connection information via the cloud-based system to the mobile application and the one or more virtual lightweight application connector instances, wherein the virtual lightweight application connector instances are configured to only provide outbound connections on a per-application basis based on the connection information, and wherein the private application access software is adapted to route traffic through the cloud-based system based on the connection information, thereby protecting the private application from the attack; and providing access to the private application through the mobile application via a plurality of secure tunnels. ### Claim 2 (depends on 1) The method of claim 1, wherein the request to access is received by the cloud-based system which is configured to drop any invalid request based on the authenticating, thereby protecting the private application from a denial of service attack. ### Claim 3 (depends on 1) The method of claim 1, wherein the authenticating includes translating received credentials from the mobile application into access tokens at the cloud-based system and communicating the tokens to a specific application connector of the application connectors associated with the private application. ### Claim 4 (depends on 1) The method of claim 1, wherein the private application is in one of a public cloud, a private cloud, and an enterprise network. ### Claim 5 (depends on 1) The method of claim 1, wherein the mobile application is a banking application. ### Claim 6 (depends on 1) The method of claim 1, wherein the incorporating is via one of a Software Development Kit (SDK) and a software library to be embedded within the mobile application. ### Claim 7 A non-transitory computer-readable storage medium having computer readable code stored thereon for programming at least one processor to perform steps of: responsive to i) incorporating private application access software in a mobile application that operates on a user device to provide functionality to an end user, the private application access software enabling traffic associated with the mobile application to be forwarded to a cloud-based system, and ii) deploying one or more virtual lightweight application connector instances in front of a private application that is accessed by the mobile application, receiving a request to access the private application; authenticating the end user based on credentials provided through the mobile application; responsive to the authentication, providing connection information via the cloud-based system to the mobile application and the one or more virtual lightweight application connector instances, wherein the virtual lightweight application connector instances are configured to only provide outbound connections on a per-application basis based on the connection information, and wherein the private application access software is adapted to route traffic through the cloud-based system based on the connection information, thereby protecting the private application from the attack; and providing access to the private application through the mobile application via a plurality of secure tunnels. ### Claim 8 (depends on 7) The non-transitory computer-readable storage medium of claim 7, further comprising dropping any invalid request in the cloud-based system based on the authenticating, thereby protecting the private application from the attack. ### Claim 9 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein the authenticating includes translating received credentials from the mobile application into access tokens at the cloud-based system and communicating the tokens to a specific application connector of the application connectors associated with the private application. ### Claim 10 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein the private application is in one of a public cloud, a private cloud, and an enterprise network. ### Claim 11 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein the mobile application is a banking application. ### Claim 12 (depends on 7) The non-transitory computer-readable storage medium of claim 7, wherein the incorporating is via a Software Development Kit (SDK). ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the SDK is configured to translate login information into an access token for authentication to an application connector. ### Claim 14 A cloud-based system comprising: one or more processors and memory storing instructions that, when executed, cause the one or more processors to responsive to i) incorporating private application access software in a mobile application that operates on a user device to provide functionality to an end user, the private application access software enabling traffic associated with the mobile application to be forwarded to the cloud-based system, and ii) deploying one or more virtual lightweight application connector instances in front of a private application that is accessed by the mobile application, receive a request to access the private application, authenticate the end user based on credentials provided through the mobile application, responsive to the authentication, providing connection information via the cloud-based system to the mobile application and the one or more virtual lightweight application connector instances, wherein the virtual lightweight application connector instances are configured to only provide outbound connections on a per-application basis based on the connection information, and wherein the private application access software is adapted to route traffic through the cloud-based system based on the connection information, thereby protecting the private application from the attack; and provide access to the private application through the mobile application via a plurality of secure tunnels. ### Claim 15 (depends on 14) The cloud-based system of claim 14, wherein the instructions that, when executed, cause the one or more processors to drop any invalid request in the cloud-based system based on the authenticating, thereby protecting the private application from the attack. ### Claim 16 (depends on 14) The cloud-based system of claim 14, wherein the authenticating includes translating received credentials from the mobile application into access tokens at the cloud-based system and communicating the tokens to a specific application connector of the application connectors associated with the private application. ### Claim 17 (depends on 14) The cloud-based system of claim 14, wherein the private application is in one of a public cloud, a private cloud, and an enterprise network.