Using non-routable addressing to reduce attack surface in secure access systems
Techniques for a client device configured with a kernel driver framework (KDF) to establish connection(s) with target workload(s) provisioned in remote network(s) (e.g., an enterprise network) using non-routable synthetic IP address(es) (e.g., a loopback address within a link-local address range, a unique local address within a discard prefix range, and/or the like). The KDF may intercept DNS requests from application(s) executing on a client device, generate and return a synthetic IP address associated with a given domain in the DNS request, and establish a connection with a secure access gateway using the non-routable synthetic IP address. Additionally, the KDF may invoke an external browser with an authentication redirect to a randomly generated synthetic IP address on a randomly generated port, where a local listener on a client device may listen on the synthetic IP address and random port to obtain and/or store authentication data for later use.
1 . A method comprising:
receiving, from an application executing on a device in a first network domain, a first request to access a target workload provisioned in a second network domain;
determining a network policy associated with the second network domain;
identifying, based at least in part on the network policy, a policy rule associated with accessing the target workload provisioned in the second network domain;
determining, based at least in part on identifying the policy rule, that the target workload indicated by the first request is associated with the policy rule;
generating a synthetic internet protocol (IP) address associated with the target workload based at least in part on determining that the target workload is associated with the policy rule;
storing a first mapping between the synthetic IP address and the target workload;
receiving a second request to connect to the target workload from the application, the second request indicating the synthetic IP address; and
establishing a first connection between the application and a secure access gateway associated with the target workload based at least in part on the first mapping between the synthetic IP address and the target workload.
2 . The method of claim 1 , wherein the synthetic IP address is randomly generated.
3 . The method of claim 1 , wherein the synthetic IP address is one of a loopback address within a link-local address range or a unique local address within a discard prefix range.
4 . The method of claim 1 , wherein the first request is a domain name system (DNS) request and the second request indicates a request to connect to a resolved address, and the method further comprising:
sending, to the application and in response to the DNS request, a synthesized DNS response, the synthesized DNS response indicating the synthetic IP address as the resolved address.
5 . The method of claim 1 , wherein the synthetic IP address is a first synthetic IP address, and the method further comprising:
receiving, from the secure access gateway, a third request to authenticate the first request to access the target workload;
generating a random domain name associated with the device;
generating a second synthetic IP address associated with the device;
storing a second mapping between the second synthetic IP address and the random domain name;
causing a loopback listener on the device to listen on the second synthetic IP address on a random port;
invoking an external browser on the device in response to the third request, the external browser being redirected to the random domain name and the random port; and
receiving, by the loopback listener, authentication data associated with the third request to authenticate the first request to access the target workload.
6 . The method of claim 1 , wherein the second network domain is associated with an enterprise.
7 . The method of claim 1 , wherein the first mapping comprises a fully qualified domain name (FQDN) mapping indicating a domain name of the target workload.
8 . A device comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, from an application executing on the device, a first request to access a target workload provisioned in a remote network domain;
determining a network policy associated with the remote network domain;
identifying, based at least in part on the network policy, a policy rule associated with accessing the target workload provisioned in the remote network domain;
determining, based at least in part on identifying the policy rule, that the target workload indicated by the first request is associated with the policy rule;
generating a synthetic internet protocol (IP) address associated with the target workload based at least in part on determining that the target workload is associated with the policy rule;
storing a first mapping between the synthetic IP address and the target workload;
receiving a second request to connect to the target workload from the application, the second request indicating the synthetic IP address; and
establishing a first connection between the application and a secure access gateway associated with the target workload based at least in part on the first mapping between the synthetic IP address and the target workload.
9 . The device of claim 8 , wherein the synthetic IP address is one of an IP version 4 (IPv4) or an IP version 6 (IPv6) address.
10 . The device of claim 8 , wherein establishing the first connection between the application and the secure access gateway is further based at least in part on a random port associated with the device.
11 . The device of claim 8 , wherein the first connection between the application and the secure access gateway comprises one of a hypertext transfer protocol version 2 (HTTP/2) connection or an HTTP/3 connection, and the operations further comprising sending a stream of bytes from the application and to the secure access gateway via the first connection.
12 . The device of claim 8 , wherein the application is a first application, the synthetic IP address is a first synthetic IP address, and the operations further comprising:
receiving, from a second application executing on the device, a third request to access the target workload provisioned in the remote network domain;
determining that the target workload indicated by the third request is associated with the policy rule;
generating a second synthetic IP address associated with the target workload based at least in part on determining that the target workload is associated with the policy rule;
storing a second mapping between the second synthetic IP address, the target workload, and the second application;
receiving a fourth request to connect to the target workload from the second application, the fourth request indicating the second synthetic IP address; and
establishing a second connection between the second application and the secure access gateway associated with the target workload based at least in part on the second mapping.
13 . The device of claim 8 , the operations further comprising determining a set of unassigned IP addresses, and wherein generating the synthetic IP address is based at least in part on randomly sampling from the set of unassigned IP addresses.
14 . The device of claim 8 , wherein the first connection between the application and the secure access gateway is a tunneled connection, and the operations further comprising:
sending an indication of the first mapping from the device and to the secure access gateway; and
sending one or more IP packets to the secure access gateway via the tunneled connection, the one or more IP packets comprising the synthetic IP address.
15 . A method comprising:
receiving, at an application on a device, an authentication request to establish a connection between the application and a target workload;
generating a random domain name associated with the device;
generating a synthetic internet protocol (IP) address associated with the device, wherein the synthetic IP address is non-routable on the client device;
storing the synthetic IP address in association with the random domain name;
causing a loopback listener on the device to listen on the synthetic IP address on a random port;
invoking an external browser on the device in response to the authentication request, the external browser being redirected to the random domain name and the random port; and
receiving, by the loopback listener, authentication data associated with the authentication request to establish the connection between the application and the target workload.
16 . The method of claim 15 , further comprising:
receiving an input associated with the authentication request via the external browser; and
establishing the connection between the device and the target workload based at least in part on the input.
17 . The method of claim 15 , wherein the synthetic IP address is one of a loopback address within a link-local address range or a unique local address within a discard prefix range.
18 . The method of claim 15 , wherein the synthetic IP address is one of an IP version 4 (IPv4) or an IP version 6 (IPv6) address.
19 . The method of claim 15 , wherein the authentication request is received via an embedded browser associated with the application, and the method further comprising:
generating an authentication token based at least in part on the authentication data;
storing the authentication token; and
invoking the embedded browser to respond to the authentication request with the authentication token.
20 . The method of claim 15 , wherein the authentication request is received from a secure access gateway associated with accessing the target workload and the connection comprises a first connection between the application and the secure access gateway and a second connection between the secure access gateway and the target workload.