Abstract: Disclosed herein are system, method, and computer program product embodiments for identity-based internet protocol networking. An embodiment operates by receiving a packet from a device of a secured network. A strength of authentication of the device is determined based on how a user account associated with the device is authenticated. A policy corresponding to the strength of authentication is determined. The packet is transmitted based upon the policy.

Abstract: Disclosed herein are system, method, and computer program product embodiments for identity-based internet protocol networking. An embodiment operates by receiving a packet from a device of a secured network. A strength of authentication of the device is determined based on how a user account associated with the device is authenticated. A policy corresponding to the strength of authentication is determined. The packet is transmitted based upon the policy.

Abstract: A network architecture that eliminates anonymous traffic, reduces a threat surface, and enforces policies is described herein. A method based on this network architecture includes receiving, by a processor, an IP packet entering a network, inserting, by the processor, an identity-based internet protocol (IBIP) shim between a header and a body of the IP packet and incorporating, by the processor, an identity of a source and a destination of the IP packet in the shim.

Abstract: A mechanism to allow hosts on the plaintext side of IP-layer encryptors to utilize Performance Enhancing Proxies (PEPs) on the ciphertext side of IP-layer encryptors is provided. Two processes are utilized for each IP-layer encryptor to extend a higher-level protocol (as represented, for example, by OSI layers 4-7) from the plaintext or red-side of the IP-layer encryptor to the ciphertext or black-side of the IP-layer encryptor. These two processes are known as the red-side Performance Enhancing Proxy Enabler (PEPE) and the black-side PEPE. The red-side and black-side PEPEs of a local IP-layer encryptor work together with red-side and black-side PEPEs of a remote IP-layer encryptor to transmit packets between the IP-layer encryptors using a higher-level protocol. Hence, PEPEs allow packets exchanged by red-side hosts separated by IP-layer encryptors to be transmitted on the black-side using a higher-level protocol. Therefore, PEPEs allow hosts on the red-side to take advantage of PEPs on the black-side.