In a communication session in which data flows with encrypted data packets pass through a monitoring intermediary for data traffic control. The encrypted data packets include SPIs (Secured Parameter Indexes) which are used to identify SAs (Security Associations) for data decryption. During the initial signaling process for the communication session, the nodes seeking the communication session include the SPIs in the signaling messages and send the signaling messages through the monitoring intermediary which in turn matches the SPIs of the signaling messages with the corresponding SPIs extracted from the data packets. In enforcing data traffic control, the monitoring intermediary allows data flows to pass through if comparison matches in the SPIs are found. Otherwise, the data flows are rejected.