Mid-link server having a plurality of access resource servers for policy control

A system for policy-controlled communication over the Internet between a plurality of remote services and a plurality of third party applications executing on a client device, the system comprising:

• one or more processors coupled to one or more memories,
• a client endpoint function that executes on the client device while coupled to a first VPN tunnel, the client endpoint function comprising:
• a first policy component, enforcing a plurality of policies on network packet traffic for a plurality of applications, wherein the plurality of policies specify one or more aspects of processing of network sessions from a third party application to a remote service,
• a first interceptor component that identifies network packet traffic and network sessions compliant with the plurality of policies, and
• a first VPN endpoint component, which provides a connection to a mid-link server using a first VPN tunnel operating in accordance with the plurality of policies,
• a service endpoint function that operates a remote service of the plurality of remote services, the service endpoint function at a service location, the service endpoint function comprising:
• a second interceptor component that identifies network packet traffic using the plurality of policies, and
• a second VPN endpoint component that connects to the mid-link server using a second VPN tunnel operating in accordance with the plurality of policies,
• a gateway server comprising a first VPN termination point that authenticates and terminates the first VPN tunnel,
• a stitcher server comprising a second VPN termination point that authenticates and terminates the second VPN tunnel, and
• a mid-link server, coupled to the first VPN tunnel and the second VPN tunnel, the mid-link server comprising:
• a plurality of Access Resource Servers (ARSs), wherein the gateway server and the stitcher server communicate via a network connecting the plurality of ARSs, and the plurality of ARSs comprise:
• a second policy component, wherein the second policy component uses the plurality of policies to specify at least:
• policy-based routing, packet re-addressing, and content mediation rules on packet traffic arriving from the first VPN tunnel,
• a router component, wherein the router component operates to route network packet traffic between the first and second VPN tunnels via a route specified by the plurality of policies,
• an inspection component that analyzes network packet traffic in accordance with the plurality of policies, and
• a mediation component, effective to mask network addresses of the client device and service devices from each other, wherein the third party application operates with the remote service to provide functionality to the client device.