Patent ID: 11863588
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 12:
13. A client device of an enterprise, comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
determine that an application running on the client device is attempting to establish communication with a network-based resource of the enterprise;
send telemetry data from the client device to the network-based resource for an analysis, the telemetry data indicating a posture of at least one of an application on the client device or the client device;
receive a determination of a security posture of the at least one of the application or the client device from the network-based resource;
determine that the application established, or is establishing, a communication session with an application service;
determine a required level of security required for the communication session based at least in part on the application service and the application is connecting to, or has connected to;
determine whether the required level of security required for the communication session is satisfied by a first level of security associated with routing via a virtual private network (VPN) to the application service, or a second level of security associated with routing directly over an Internet with lean-trust security to the application service by determining that a network controller can trust the telemetry data associated with the client device by:
determining a secure boot function has occurred;
determining a mobile device management (MDM) is activated securely; and
validating that an agent was securely activated as part of the secure boot function;

in response to determining the required level of security required for the communication session is satisfied by the first level of security, instructing, by the network controller, the agent running on the client device to route the communication session via the VPN to the network-based resource; and
in response to determining the required level of security for the communication session is satisfied by the second level of security, instructing by the network controller, the agent running on the client device to route the communication session over the Internet with lean-trust security to the network-based resource.