# US 12,224,981 B2 · Techniques for onboarding web applications in a zero trust environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,981 B2 - Document ID: US12224981B2 - Status: Granted - Kind: B2 - Application number: 17/804,718 - Filed: 2022-05-31 - Published: 2023-11-30 - Granted: 2025-02-11 - Earliest claimed: 2022-05-31 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Yehoshua Haim Chen; Shay Farhuma Gutman; Omri Himelbrand; Gilad Kleinman; Shay Shwartz; Natan Elul - Web page: https://patentgrep.com/patent/US12224981B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for providing external resources through a zero trust environment includes recording a web session of a first user to generate a policy allowing a second user to access the resource used in the web session. The method includes receiving a request to initiate a network session with the zero trust environment, the request including login credentials, wherein the login credentials correspond to an authorizing user account; receiving a request to access a resource in a network environment which is external to the zero trust environment; detecting in the request a domain associated with the resource; and configuring a policy engine of the zero trust environment to generate a policy allowing network traffic between the domain and a designated user account, based on the received request. ## Claims ### Claim 1 A method comprising: receiving, at a system comprising a hardware processor, a request from an authorizing user device to initiate a network session with a zero trust environment, the request including a login credential corresponding to an authorizing user account; recording, at the system, an interaction between the authorizing user device and a resource external to the zero trust environment, the interaction based on an access request of the authorizing user device to access the resource; detecting, by the system, a domain associated with the resource accessed by the authorizing user device; generating, by the system, a policy based on the recording of the interaction, the policy comprising a rule specifying a condition under which a designated user account different from the authorizing user account is permitted access to the domain; and using, by a policy engine, the policy to determine whether to grant a designated user device associated with the designated user account access to the domain in response to a request from the designated user device, wherein the designated user account is assigned a privilege from the authorizing user device, the privilege allowing the designated user account to generate the request from the designated user device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: detecting in the access request a further domain associated with the resource; and generating, by the system, another policy blocking network traffic between the further domain and the designated user account. ### Claim 3 (depends on 1) The method of claim 1, wherein the generating of the policy further comprises: creating a list of domains that the authorizing user device interacted with as part of the network session, wherein the policy refers to one or more conditions under which the designated user account is permitted access to the domains in the list of domains. ### Claim 4 (depends on 3) The method of claim 3, wherein the list of domains is a first list of domains actively requested by the authorizing user device based on actions of an authorizing user of the authorizing user device, and wherein the generating of the policy further comprises: creating a second list of one or more domains not actively requested by the authorizing user device during the network session, wherein the policy blocks access to the domains in the second list of one or more domains by the designated user account. ### Claim 5 (depends on 1) The method of claim 1, wherein the access request includes a uniform resource locator (URL) comprising the domain. ### Claim 6 (depends on 5) The method of claim 5, further comprising: fetching content based on the URL; detecting in the content a second URL, the second URL having a domain which is not the domain of the URL; and rewriting the content to replace the second URL with a further URL, wherein the further URL includes a domain of the zero trust environment. ### Claim 7 (depends on 6) The method of claim 6, wherein the further URL further includes a unique subdomain which is generated based on the domain of the second URL. ### Claim 8 (depends on 6) The method of claim 6, further comprising: receiving a request to fetch content based on the rewritten content; resolving the further URL to the second URL; fetching content based on the second URL; and providing the content based on the second URL to the authorizing user device through the zero trust environment. ### Claim 9 A non-transitory computer readable medium comprising instructions that upon execution cause a system to: receive a request from an authorizing user device to initiate a network session with a zero trust environment, the request including a login credential corresponding to an authorizing user account; record an interaction between the authorizing user device and a resource external to the zero trust environment, the interaction based on an access request of the authorizing user device to access the resource; detect a domain associated with the resource accessed by the authorizing user device; generate a policy based on the recording of the interaction, the policy comprising a rule specifying a condition under which a designated user account different from the authorizing user account is permitted access to the domain; and use, by a policy engine, the policy to determine whether to grant a designated user device associated with the designated user account access to the domain in response to a request from the designated user device, wherein the designated user account is assigned a privilege from the authorizing user device, the privilege allowing the designated user account to generate the request from the designated user device. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the generating of the policy further comprises: creating a list of domains that the authorizing user device interacted with as part of the network session, wherein the policy refers to one or more conditions under which the designated user account is permitted access to the domains in the list of domains. ### Claim 11 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the list of domains is a first list of domains actively requested by the authorizing user device based on actions of an authorizing user of the authorizing user device, and wherein the generating of the policy further comprises: creating a second list of one or more domains not actively requested by the authorizing user device during the network session, wherein the policy blocks access to the domains in the second list of one or more domains by the designated user account. ### Claim 12 A system for a zero trust environment, comprising: processing circuitry; and a non-transitory storage medium storing instructions executable by the processing circuitry to: receive a request from an authorizing user device to initiate a network session with the zero trust environment, the request including a login credential corresponding to an authorizing user account; record an interaction between the authorizing user device and a resource external to the zero trust environment, the interaction based on an access request of the authorizing user device to access the resource; detect a domain associated with the resource accessed by the authorizing user device; generate a policy based on the recording of the interaction, the policy comprising a rule specifying a condition under which a designated user account different from the authorizing user account is permitted access to the domain; and use, by a policy engine, the policy to determine whether to grant a designated user device associated with the designated user account access to the domain in response to a request from the designated user device, wherein the designated user account is assigned a privilege from the authorizing user device, the privilege allowing the designated user account to generate the request from the designated user device. ### Claim 13 (depends on 12) The system of claim 12, wherein the instructions are executable by the processing circuitry to further: detect in the access request a further domain associated with the resource; and generate another policy blocking network traffic between the further domain and the designated user account. ### Claim 14 (depends on 12) The system of claim 12, wherein the generating of the policy further comprises: creating a list of domains that the authorizing user device interacted with as part of the network session, wherein the policy refers to one or more conditions under which the designated user account is permitted access to the domains in the list of domains. ### Claim 15 (depends on 14) The system of claim 14, wherein the list of domains is a first list of domains actively requested by the authorizing user device based on actions of an authorizing user of the authorizing user device, and wherein the generating of the policy further comprises: creating a second list of one or more domains not actively requested by the authorizing user device during the network session, wherein the policy blocks access to the domains in the second list of one or more domains by the designated user account. ### Claim 16 (depends on 12) The system of claim 12, wherein the access request includes a uniform resource locator (URL) comprising the domain, and the instructions are executable by the processing circuitry to further: fetch content based on the URL; detect in the content a second URL, the second URL having a domain which is not the domain of the URL; and rewrite the content to replace the second URL with a further URL, wherein the further URL includes a domain of the zero trust environment. ### Claim 17 (depends on 16) The system of claim 16, wherein the further URL further includes a unique subdomain which is generated based on the domain of the second URL. ### Claim 18 (depends on 16) The system of claim 16, wherein the instructions are executable by the processing circuitry to further: receive a request to fetch content based on the rewritten content; resolve the further URL to the second URL; fetch content based on the second URL; and provide the content based on the second URL to the authorizing user device through the zero trust environment.