Authenticating and enforcing compliance of devices using external services

A method for determining whether an electronic computing device complies with the security policy for an electronic communications and data network of electronic computer devices, the method comprising:

• establishing a virtual private network (VPN) connection with the electronic computing device, an identity provider, and a VPN concentrator;
• receiving at the VPN concentrator intercepted and redirected messages from the electronic computing device;
• receiving over from the electronic computing device the VPN connection an electronic request signal, the electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of the electronic computer device to establish electronic communication with a specific target electronic device or service operating on the electronic communications and data network;
• receiving from the electronic computing device electronically encoded information about the identity of the electronically encoded process, the electronic computing device, or the user of the electronic computing device;
• receiving from a policy store electronically encoded policy elements for the security policy;
• receiving from the VPN connection electronically encoded information related to the identity of the principal of the electronic computing device;
• and
• determining at the identity provider whether the electronic computing device complies with the security policy using the request, the identity, the principal identity information, and the policy elements.

A non-transitory computer-readable medium, containing electronically encoded computer readable program control devices thereon, the electronically encoded computer readable program control devices being configured to enable an electronic computer to perform electronic computer operations comprising:

• establishing a virtual private network (VPN) connection with the electronic computing device, an identity provider, and a VPN concentrator;
• receiving at the VPN concentrator intercepted and redirected messages from the electronic computing device;
• receiving over from the electronic computing device the VPN connection an electronic request signal, the electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of the electronic computer device to establish electronic communication with a specific target electronic device or service operating on the electronic communications and data network;
• receiving from the electronic computing device electronically encoded information about the identity of the electronically encoded process, the electronic computing device, or the user of the electronic computing device;
• receiving from a policy store electronically encoded policy elements for the security policy;
• receiving from a compliance server electronically encoded information about the compliance of the electronic computing device with respect to the security policy;
• determining at the identity provider whether the electronic computing device complies with the security policy using the request, the identity, the principal identity information, and the policy elements.