Identity based network policy enablement

A method for identifying at least one of two endpoint peers in a communication session that comprises a communication path with three or more entities wherein the three or more entities comprise two endpoint peers and one or more intermediaries, the method performed by an intermediary and comprising:

• generating an intermediary stamp;
• the intermediary stamp comprising a nonce;
• including the intermediary stamp in a first message originating from an endpoint peer for establishing the communication session between the two endpoint peers;
• transmitting the first message with the intermediary stamp on to the next entity in the communication path for the communication session;
• receiving a second message originating from a first of the two endpoint peers wherein the second message comprises the intermediary stamp generated by the intermediary and a signature identification of the first of the two endpoint peers, the signature identification comprising a hash of data that includes the intermediary stamp;
• authenticating the identity of the first of the two endpoint peers using the signature identification for the first of the two endpoint peers and certificate information for the first of the two endpoint peers, the signature including a hash of the intermediary stamp;
• identifying the first of the two endpoint peers with the certificate information for the first endpoint peer;
• correlating one or more identity based rules with the identity of the first of the two endpoint peers;
• receiving a data packet originating from the first of the two endpoint peers;
• and
• applying at least one of the one or more identity based rules to the processing of the data packet for transmission on in the communication path for the communication session.

A computing device readable medium having computing device executable instructions stored thereon that when executed by a processor of a computing device implement a method for enabling identification of at least one of two endpoint peers in a communication session comprising a communication path comprising an intermediary, the computing device readable medium comprising:

• computing device executable instructions for the intermediary in the communication path for the communication session to receive a first message originating from one of the two endpoint peers, the first message having an application-level identifier to be used by the other of the endpoint peer in establishing an application-level communication session;
• computing device executable instructions for the intermediary in the communication path for the communication session to generate an intermediary stamp and add the intermediary stamp to the first message originating from the one of the two endpoint peers;
• computing device executable instructions for the intermediary in the communication path for the communication session to transmit the first message with the added intermediary stamp on to the next entity in the communication path for the communication session;
• computing device executable instructions for the intermediary in the communication path for the communication session to receive a second message originating from one of the two endpoint peers wherein the second message comprises the intermediary stamp for the intermediary, a signature identification for one of the two endpoint peers and a certificate for one of the two endpoint peers;
• computing device executable instructions for the intermediary in the communication path for the communication session to authenticate the identity of one of the two endpoint peers using the signature identification for the one of the two endpoint peers and the certificate for the one of the two endpoint peers, the signature identification comprising a hash of both the application-level identifier and the intermediary stamp;
• computing device executable instructions for the intermediary in the communication path for the communication session to identify one of the two endpoint peers using the certificate for the one of the two endpoint peers;
• computing device executable instructions for the intermediary in the communication path for the communication session to receive a data packet originating from the one of the two endpoint peers;
• and
• computing device executable instructions for the intermediary in the communication path for the communication session to apply at least one identity based rule correlated with the identity of the one of the two endpoint peers to the processing of the data packet for transmission on in the communication path for the communication session.