Patent ID: 11863588
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method, comprising:
determining that an application running on a client device is attempting to establish a communication session with a network-based resource of an enterprise;
obtaining telemetry data associated with the client device from at least one of an agent running locally on the client device or the network-based resource;
analyzing the telemetry data to determine a security posture of at least one of the client device or the application;
determining that the application is connecting to an application service associated with the network-based resource;
determining a required level of security required for the communication session based at least in part on the application service and the security posture;
determining, at a network controller, whether the required level of security required for the communication session is satisfied by a first level of security associated with routing via a virtual private network (VPN) to the application service, or a second level of security associated with routing directly over an Internet with lean-trust security to the application service by determining that the network controller can trust the telemetry data associated with the client device by:
determining a secure boot function has occurred;
determining a mobile device management (MDM) is activated securely; and
validating that the agent was securely activated as part of the secure boot function;
in response to determining the required level of security required for the communication session is satisfied by the first level of security, instructing, by the network controller, the agent running on the client device to route the communication session via the VPN to the network-based resource; and

in response to determining the required level of security required for the communication session is satisfied by the second level of security, instructing, by the network controller, the agent running on the client device to route the communication session over the Internet with lean-trust security to the network-based resource.