Next gen zero trust network access (ZTNA) and virtual private network (VPN) including cloud secure access service edge (SASE)
Techniques for leveraging the MASQUE protocol to provide remote clients with full application access to private enterprise resources are described herein. One or more network nodes may be configured to execute a MASQUE proxy service to provide a remote client device with full access to an enterprise/private application resource executing on an application node and hosted in an enterprise/application network, behind the MASQUE proxy service. In some examples, the MASQUE proxy service may execute on a single proxy node hosted at an edge of a cloud network or at an edge of an enterprise network. Additionally, or alternatively, a first instance of the MASQUE proxy service may execute on a first proxy node hosted at an edge of a cloud network (e.g., an ingress proxy node) and a second instance of the MASQUE proxy service may execute on a second proxy node hosted at an edge of the enterprise network.
1. A method comprising:
receiving, at one or more nodes executing a multiplexed application substrate over QUIC encryption (MASQUE) proxy service and from a client device, a hypertext transfer protocol (HTTP) request;
identifying, by the MASQUE proxy service, an endpoint identifier in a header field of the HTTP request;
sending, by the MASQUE proxy service and to a domain name service (DNS) server, a DNS resolution request including the endpoint identifier;
receiving, by the MASQUE proxy service and from the DNS server, an address associated with an application node associated with an enterprise network that is remote from the client device; and
establishing, at least partly by the MASQUE proxy service, a tunneled connection between the one or more nodes and the application node, wherein the tunneled connection is configured to transmit a data stream between the client device and the application node.
2. The method of claim 1 , wherein:
the MASQUE proxy service is a first MASAQUE proxy service executing on a first node of the one or more nodes, the first node being deployed at a first network edge of an enterprise network; and
the one or more nodes include a second node executing a second MASQUE proxy service, the second node being deployed at a second network edge of a cloud computing network, the cloud computing network being remote from the enterprise network.
3. The method of claim 2 , wherein the tunneled connection comprises:
a first tunneled connection communicatively coupling the first node and the second node;
a second tunneled connection communicatively coupling the first node and the application node; and
a third tunneled connection communicatively coupling the second node and the client device.
4. The method of claim 3 , wherein the enterprise network comprises a firewall service configured to apply one or more enterprise firewall rules to the data stream at the first tunneled connection.
5. The method of claim 1 , wherein establishing the tunneled connection is based at least in part on receiving, by the MASQUE proxy service and from an authentication service associated with the enterprise network, an authentication token associated with at least one of the client device or an enterprise account associated with the client device.
6. The method of claim 5 , wherein the HTTP request is a first HTTP request generated by a first application executing on the client device, the endpoint identifier is a first endpoint identifier, the address is a first address, the application node is a first application node, and the method further comprising:
receiving, by the MASQUE proxy service and from a second application executing on the client, a second HTTP request, the second application being different from the first application;
identifying, by the MASQUE proxy service, a second endpoint identifier in the header field of the second HTTP request;
sending, by the MASQUE proxy service and to a domain name service (DNS) server, an additional DNS resolution request including the second endpoint identifier;
receiving, by the MASQUE proxy service and from the DNS server, a second address associated with a second application node;
determining, by the MASQUE proxy service and based at least in part on the second address, that the second application node is associated with the enterprise network; and
establishing, by the MASQUE proxy service and based at least in part on the authentication token, an additional tunneled connection between the client device and the second application node.
7. The method of claim 1 , wherein:
the MASQUE proxy service is executing on a first node of the one or more nodes, the first node being deployed in a cloud computing network; and
the one or more nodes include a second node executing a secure access service edge (SASE) service deployed in the cloud computing network, the SASE service being configured to apply one or more cloud-based security services to the data stream.
8. The method of claim 1 , wherein:
the MASQUE proxy service is executing on a first node of the one or more nodes, the first node being deployed in a cloud computing network; and
the application node is communicatively coupled to the first node via an internet protocol secure (IPSec) connection or a point-to-point virtual private network (VPN) connection.
9. A system comprising:
one or more processors; and
one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, at a multiplexed application substrate over QUIC encryption (MASQUE) proxy service and from a client device, a hypertext transfer protocol (HTTP) request;
identifying, by the MASQUE proxy service, an endpoint identifier in a header field of the HTTP request;
sending, by the MASQUE proxy service and to a domain name service (DNS) server, a DNS resolution request including the endpoint identifier;
receiving, by the MASQUE proxy service and from the DNS server, an address associated with an application node; and
establishing, at least partly by the MASQUE proxy service, a tunneled connection between the MASQUE proxy service and the application node, wherein the tunneled connection is configured to transmit a data stream between the client device and the application node.
10. The system of claim 9 , wherein:
the MASQUE proxy service is a first instance of the MASQUE proxy service executing on a first proxy node of one or more nodes, the first proxy node being deployed at a first network edge of an enterprise network;
the one or more nodes include a second proxy node executing a second instance of the MASQUE proxy service, the second proxy node being deployed at a second network edge of a cloud computing network; and
the application node is associated with the enterprise network.
11. The system of claim 10 , wherein the tunneled connection comprises:
a first tunneled connection communicatively coupling the first proxy node and the second proxy node;
a second tunneled connection communicatively coupling the first proxy node and the application node; and
a third tunneled connection communicatively coupling the second proxy node and the client device.
12. The system of claim 9 , wherein:
the MASQUE proxy service is executing on a first proxy node of one or more nodes, the first proxy node being deployed in a cloud computing network; and
the application node is associated with an enterprise network, the application node being communicatively coupled to the first proxy node via an internet protocol secure (IPSec) connection or a point-to-point virtual private network (VPN) connection.
13. The system of claim 9 , wherein the MASQUE proxy service is executing on a first proxy node of one or more nodes, the first proxy node being deployed in an enterprise network associated with at least one of the DNS server or the application node.
14. The system of claim 9 , wherein:
the MASQUE proxy service is executing on a first proxy node of one or more nodes, the first proxy node being deployed in a cloud computing network; and
the one or more nodes include a second proxy node executing a secure access service edge (SASE) service deployed in the cloud computing network, the SASE service being configured to apply one or more cloud-based security services to the data stream.
15. A method comprising:
receiving, at a multiplexed application substrate over QUIC encryption (MASQUE) proxy service and from a client device, a hypertext transfer protocol (HTTP) request;
identifying, by the MASQUE proxy service, an endpoint identifier in a header field of the HTTP request;
sending, by the MASQUE proxy service and to a domain name service (DNS) server, a DNS resolution request including the endpoint identifier;
receiving, by the MASQUE proxy service and from the DNS server, an address associated with an application node; and
establishing, at least partly by the MASQUE proxy service, a tunneled connection between the MASQUE proxy service and the application node, wherein the tunneled connection is configured to transmit a data stream between the client device and the application node.
16. The method of claim 15 , wherein the header field of the HTTP request is encrypted using a hybrid public key encryption (HPKE) as an encrypted header field, and the method further comprising:
decrypting, by the MASQUE proxy service, the encrypted header field; and
wherein identifying the endpoint identifier is based at least in part on decrypting the encrypted header field.
17. The method of claim 16 , wherein:
the MASQUE proxy service is a first instance of the MASQUE proxy service executing on a first proxy node of one or more nodes, the first proxy node being deployed at a first network edge of an enterprise network;
the one or more nodes include a second proxy node executing a second instance of the MASQUE proxy service, the second proxy node being deployed at a second network edge of a cloud computing network; and
the encrypted header field is inaccessible by the second instance of the MASQUE proxy service.
18. The method of claim 15 , wherein:
the application node is deployed in an enterprise network; and
establishing the tunneled connection is based at least in part on receiving, by the MASQUE proxy service and from an authentication service associated with the enterprise network, an authentication token associated with at least one of the client device or an enterprise account associated with the client device.
19. The method of claim 15 , wherein the HTTP request is generated by at least one of:
an operating system executing on the client device;
a thick application executing on the client device;
a thin application executing on the client device;
a virtual private network (VPN) client executing on the client device; or
a web browser executing on the client device.
20. The method of claim 15 , wherein the application node is configured as an enterprise application deployed in an enterprise network or a software as a service (SaaS) application associated with the enterprise network.