0-RTT capable, tunnel-less, multi-tenant policy architecture

A method for packet handling over a network, the method comprising:

• communicating packets from a client device over a network;
• intercepting traffic from users;
• determining a packet type, wherein when a packet is a Synchronize packet, opening a pair of streams with consecutive stream IDs to communicate over the network;
• and
• wherein the first stream of the pair carries a 5-tuple and metadata for the communication from the client device;
• and
• the second stream of the pair carries the TCP packet for the communication from the client device;
• receiving the pair of streams at a server device communicating over the network with the client device;
• detecting, at the server device, the 5-tuple and metadata from the first stream;
• searching the next stream ID for the TCP packet;
• and
• saving the 5-tuple to an in-memory cache database, wherein the TCP is extracted from the stream and a connection is made to a protected application with the client.

A client device configured to communicate over a network comprising:

• a Multi Tenant Module-Client module (MTM-Client module) comprising processor-readable instructions to direct at least one client device processor to intercept traffic from enterprise users and determines a packet type, wherein when a packet is a Synchronize packet, the MTM-Client module opens a pair of streams with consecutive stream IDs to communicate over the network;
• and
• the first stream of the pair carries a 5-tuple and metadata which includes the site-id or tenant-id for the communication from the client device;
• and
• the second stream of the pair carries a TCP packet for the communication from the client device;
• and
• a service device is configured to receive the packet and dismantles the packet into a stream which is processed using a policy engine to validate the packet to establish a connection between the server and the client.

A server device configured to communicate over a network with a client device, the server device further comprising:

• a Multi Tenant Module-Server module (MTM-Server module) comprising processor-readable instructions to direct at least one server device processor to receive a plurality of packets and each packet is dismantled into streams, wherein when a stream contains a 5-tuple, then this 5-tuple is sent to a policy engine to run a policy on it and metadata from a first stream is detected;
• and search for the next stream ID for a TCP packet that will contain a payload that is buffered;
• when a policy denies a connection for the 5-tuple then a stream close message is sent and the client device will close the corresponding TCP connection;
• and
• when the policy approves the connection, the MTM-Server module saves the 5-tuple to an in-memory cache database, wherein the TCP is extracted from the stream and a connection is made to a protected application with the client.