# US 2024/0205189 A1 · Systems and methods for internal secure network resolution > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205189 A1 - Document ID: US20240205189A1 - Status: Published application - Kind: A1 - Application number: 18/592,333 - Filed: 2024-02-29 - Published: 2024-06-20 - Earliest claimed: 2021-09-01 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Weining Wu; Kunal Marwah; Jinhai Yang; Xu Zheng - Web page: https://patentgrep.com/patent/US20240205189A1 ## CPC - H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 41/12: Discovery or management of network topologies - H04L 61/4511: using domain name system [DNS] - H04L 61/58: Caching of addresses or names - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, devices, and methods are discussed for limiting exposure of internal network operations beyond the boundary of a secure network. ## Claims ### Claim 1 A method comprising: intercepting, by an endpoint security application of an endpoint device associated with a secured network, a request to access a particular network resource within the secured network, wherein the request for the particular network resource includes a domain name corresponding to the particular network resource; accessing, by the endpoint security application, an internal list of domain names maintained within the secure network, wherein the internal list of domain names includes a plurality of domain names each identifying a given network resource of a plurality of network resources accessible on the secured network and corresponding to an internet protocol (IP) address of the given network resource; based at least in part on determining that the particular network resource is included in the internal list of domain names, limiting exposure of internal network operations of the secured network, by locally resolving, by the endpoint security application, the IP address of the particular network resource with reference to the internal list of domain names; and returning, by the endpoint security application, a response to the request including the IP address in a form that appears to the endpoint device to be from a domain name system (DNS). ### Claim 2 (depends on 1) The method of claim 1, wherein the response is returned in a message format used by a DNS server external to the secured network. ### Claim 3 (depends on 1) The method of claim 1, further comprising receiving, by the endpoint security application, the internal list of domain names from a network resource within the secured network. ### Claim 4 (depends on 3) The method of claim 3, wherein the network resource comprises an endpoint management system (EMS) with which the endpoint device is registered. ### Claim 5 (depends on 4) The method of claim 4, wherein each network resource of the plurality of network resources accessible on the secured network is registered with the EMS, has a trust certificate issued by the EMS to the registered network resource, and is included on a zero-trust network access (ZTNA) access control list maintained by a network security appliance of the secured network. ### Claim 6 (depends on 1) The method of claim 1, further comprising: intercepting, by the endpoint security application, a second request to access a second particular network resource within the secured network, wherein the second request for the second particular network resource includes a second domain name corresponding to the second particular network resource; accessing, by the endpoint security application, the internal list of domain names; and based at least in part on determining that the second particular network resource is absent from the internal list of domain names, forwarding, by the endpoint security application, a domain name server request for the second domain name to a domain server outside of the secured network. ### Claim 7 (depends on 6) The method of claim 6, further comprising: receiving, by the endpoint security application, an IP address corresponding to the second domain name from the domain server; and providing, by the endpoint security application, the corresponding IP address for use by the endpoint device. ### Claim 8 A system comprising: one or more processing resources; a non-transitory computer-readable medium, coupled to the one or more processing resources, having stored therein instructions that when executed by the one or more processing resources cause the system to: intercept a request to access a particular network resource within a secured network, wherein the request for the particular network resource includes a domain name corresponding to the particular network resource; access an internal list of domain names maintained within the secure network, wherein the internal list of domain names includes a plurality of domain names each identifying a given network resource of a plurality of network resources accessible on the secured network and corresponding to an internet protocol (IP) address of the given network resource; based at least in part on a determination that the particular network resource is included in the internal list of domain names, limit exposure of internal network operations of the secured network, by locally resolving the IP address of the particular network resource with reference to the internal list of domain names; and return a response to the request including the IP address in a form that appears to be from a domain name system (DNS). ### Claim 9 (depends on 8) The system of claim 8, wherein the response is returned in a message format used by a DNS server external to the secured network. ### Claim 10 (depends on 8) The system of claim 8, wherein the instructions further cause the system to receive the internal list of domain names from a network resource within the secured network. ### Claim 11 (depends on 10) The system of claim 10, wherein the network resources comprises an endpoint management system (EMS) with which an endpoint device associated with the system is registered. ### Claim 12 (depends on 11) The system of claim 11, wherein each network resource of the plurality of network resources accessible on the secured network is registered with the EMS, has a trust certificate issued by the EMS to the registered network resource, and is included on a zero-trust network access (ZTNA) access control list maintained by a network security appliance of the secured network. ### Claim 13 (depends on 8) The system of claim 8, wherein the instructions further cause the system to: intercept a second request to access a second particular network resource within the secured network, wherein the second request for the second particular network resource includes a second domain name corresponding to the second particular network resource; access the internal list of domain names; and based at least in part on a determination that the second particular network resource is absent from the internal list of domain names, forward a domain name server request for the second domain name to a domain server outside of the secured network. ### Claim 14 A non-transitory computer-readable storage medium embodying instructions, which when executed by one or more processing resources of an endpoint device associated with a secured network, cause an endpoint security application of the endpoint device to: intercept a request by to access a particular network resource within the secured network, wherein the request for the particular network resource includes a domain name corresponding to the particular network resource; access an internal list of domain names maintained within the secure network, wherein the internal list of domain names includes a plurality of domain names each identifying a given network resource of a plurality of network resources accessible on the secured network and corresponding to an internet protocol (IP) address of the given network resource; based at least in part on a determination that the particular network resource is included in the internal list of domain names, limit exposure of internal network operations of the secured network, by locally resolving the IP address of the particular network resource with reference to the internal list of domain names; and return a response to the request including the IP address in a form that appears to the endpoint device to be from a domain name system (DNS). ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the response is returned in a message format used by a DNS server external to the secured network. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions further cause the endpoint security application to receive the internal list of domain names from a network resource within the secured network. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the network resource comprises an endpoint management system (EMS) with which the endpoint device is registered. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein each network resource of the plurality of network resources accessible on the secured network is registered with the EMS, has a trust certificate issued by the EMS to the registered network resource, and is included on a zero-trust network access (ZTNA) access control list maintained by a network security appliance of the secured network. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions further cause the endpoint security application to: intercept a second request to access a second particular network resource within the secured network, wherein the second request for the second particular network resource includes a second domain name corresponding to the second particular network resource; access the internal list of domain names; and based at least in part on a determination that the second particular network resource is absent from the internal list of domain names, forward a domain name server request for the second domain name to a domain server outside of the secured network. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the instructions further cause the endpoint security application to: receive an IP address corresponding to the second domain name from the domain server; and provide the corresponding IP address for use by the endpoint device.