Zero trust and zero knowledge application access system

A system for providing policy-controlled communication over the Internet between a plurality of remote services and a plurality of third party applications executing on a client device, the system comprising:

• a client endpoint function configured to execute on the client device while coupled to a first VPN tunnel, the client endpoint function comprising:
• a first policy component, enforcing a plurality of policies on network packet traffic for a plurality of applications, wherein the plurality of policies specify one or more aspects of processing of network sessions from a third party application to a remote service,
• an first interceptor component that identifies network packet traffic and network sessions compliant with the plurality of policies, and
• a first VPN endpoint component, which provides a connection to a mid-link server using a first VPN tunnel configured in accordance with the plurality of policies, wherein:
• the first VPN endpoint component establishes the first VPN tunnel from the client device to the mid-link server, and
• the network packet traffic being redirected by the first interceptor component to the first VPN tunnel and away from other network interfaces for the plurality of remote services;
• a service endpoint function that operates a remote service of the plurality of remote services, the service endpoint function at a service location, the service endpoint function further comprising:
• a second interceptor component that identifies network packet traffic using the plurality of policies, and
• a second VPN endpoint component that connects to the mid-link server using a second VPN tunnel configured in accordance with the plurality of policies, wherein:
• the second VPN endpoint component establishes the second VPN tunnel between the service location and the mid-link server,
• the second VPN endpoint component provides the remote service to a third party application of the plurality of third party applications running on the client device, and
• the second VPN tunnel carries the network packet traffic from the remote service and the mid-link server with the network packet traffic being related to a corresponding third party application executing on the client device;
• and
• a mid-link server, coupled to the first VPN tunnel and the second VPN tunnel, the mid-link server comprising:
• a first and second VPN termination point that authenticates and terminates the first and second VPN tunnels at a mid-link server,
• a second policy component, wherein the second policy component uses the plurality of policies to specify at least:
• policy-based routing, packet re-addressing, and content mediation rules on packet traffic arriving from the first VPN tunnel,
• a router component interposed between the first and second VPN tunnels, wherein the router component operating to route network packet traffic between the first and second VPN tunnels via a route specified by the plurality of policies,
• an inspection component that analyzes network packet traffic in accordance with the plurality of policies, and
• a mediation component, effective to mask network addresses of the client device and service devices from each other, wherein the third party application operates with the remote service to provide functionality to the client device.