Policy-based network packet inspection and mediation

A method for providing policy-controlled communication over the Internet between a plurality of remote services and a plurality of third party applications executing on a plurality of client devices, the method comprising:

• enforcing a plurality of policies on network packet traffic for a plurality of applications, wherein the plurality of policies specify one or more aspects of processing of network sessions from the plurality of third party applications to the plurality of remote services;
• identifying network packet traffic and network sessions compliant with the plurality of policies at the plurality of remote services;
• connecting to a mid-link server with a client device from the plurality of client devices using a first VPN tunnel configured in accordance with the plurality of policies;
• establishing with the first VPN tunnel from the client device to the mid-link server;
• redirecting network packet traffic to the first VPN tunnel and away from other network interfaces for the plurality of remote services;
• providing a remote service of the plurality of remote services at a service location;
• connecting the mid-link server using a second VPN tunnel configured in accordance with the plurality of policies;
• establishing the second VPN tunnel between the service location and the mid-link server, wherein:
• the service location provides the remote service to a third party application of the plurality of third party applications running on the client device, and
• the second VPN tunnel carries the network packet traffic from the remote service and the mid-link server with the network packet traffic being related to a corresponding third party application executing on the client device;
• coupling the first VPN tunnel and the second VPN tunnel with the mid-link server;
• analyzing network packet traffic in accordance with the plurality of policies, wherein the plurality of policies for the network packet traffic and the content mediation selected dynamically on the basis of one or more of a user, an application, an endpoint, and a session;
• and
• masking network addresses of the client device and remote service from each other, wherein the third party application operates with the remote service to provide functionality to the client device.

A system for providing policy-controlled communication over the Internet between a plurality of remote services and a plurality of third party applications executing on a client device of a plurality of client devices, the system comprising a plurality of servers, collectively having code for:

• enforcing a plurality of policies on network packet traffic for a plurality of applications, wherein the plurality of policies specify one or more aspects of processing of network sessions from the plurality of third party applications to the plurality of remote services;
• identifying network packet traffic and network sessions compliant with the plurality of policies at the plurality of remote services;
• connecting to a mid-link server with a client device from the plurality of client devices using a first VPN tunnel configured in accordance with the plurality of policies;
• establishing with the first VPN tunnel from the client device to the mid-link server;
• redirecting network packet traffic to the first VPN tunnel and away from other network interfaces for the plurality of remote services;
• providing a remote service of the plurality of remote services at a service location;
• connecting the mid-link server using a second VPN tunnel configured in accordance with the plurality of policies;
• establishing the second VPN tunnel between the service location and the mid-link server, wherein:
• the service location provides the remote service to a third party application of the plurality of third party applications running on the client device, and
• the second VPN tunnel carries the network packet traffic from the remote service and the mid-link server with the network packet traffic being related to a corresponding third party application executing on the client device;
• coupling the first VPN tunnel and the second VPN tunnel with the mid-link server;
• analyzing network packet traffic in accordance with the plurality of policies, wherein the plurality of policies for the network packet traffic and the content mediation selected dynamically on the basis of one or more of a user, an application, an endpoint, and a session;
• and
• masking network addresses of the client device and remote service from each other, wherein the third party application operates with the remote service to provide functionality to the client device.