Patent ID: 11863588
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 6:
7. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
receive telemetry data associated with a client device of an enterprise from at least an agent running locally on the client device, the telemetry data indicating a posture of at least one of the client device or an application on the client device;
analyze the telemetry data to determine a security posture of the at least one of the client device or the application;
determine that the application established, or is establishing, a communication session with an application service;
determine a required level of security required for the communication session based at least in part on the application service and the security posture;
determine, at a network controller and, whether the required level of security required for the communication session is satisfied by a first level of security associated with routing via a virtual private network (VPN) to the application service, or a second level of security associated with routing directly over an Internet with lean-trust security to the application service by determining that the network controller can trust the telemetry data associated with the client device by:
determining a secure boot function has occurred;
determining a mobile device management (MDM) is activated securely; and
validating that the agent was securely activated as part of the secure boot function;

in response to determining the required level of security required for the communication session is satisfied by the second level of security, instruct, by the network controller, the agent running locally on the client device to route the communication session via the VPN to the application service; and
in response to determining the required level of security required for the communication session is satisfied by the second level of security, instructing, by the network controller, the agent running on the client device to route the communication session over the Internet with lean-trust security to the application service.