Patent ID: 11888900
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 8:
9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
identify, from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
determine whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface; and

cause performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.