Authentication (AuthN) and authorization (AuthZ) binding for secure network access

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, from a device within a network, a request for a first application to access a service associated with a proxy service or a virtual private network (VPN) via a first secure session flow, wherein the proxy service comprises a multiplexed application substrate over quick user datagram protocol internet connection (QUIC) encryption (MASQUE) proxy service;
• sending, to the device and based on determining the device is unauthenticated, a first authentication request that requests user input including credentials or a unique identifier assigned to the device for authentication of the device;
• receiving, from the device, a message including a token, the token being signed using the unique identifier, the unique identifier being shared across disparate applications on the device for use in generating the token;
• authenticating, by the proxy service or the VPN, the token using the unique identifier associated with the device, wherein authentication of the token causes the proxy service or the VPN to cryptographically associate the token with subsequent independent secure session flows from the disparate applications on the device, wherein at least one authentication request for a subsequent independent secure session flow is received from a non-browser application;
• enabling, by the proxy service or the VPN, the device to access the service via the first secure session flow;
• receiving, from the device, a second request for a second application to access a second service, the second application comprising the non-browser application;
• sending, to the device, a second authentication request;
• receiving, from the device, a second token signed using the unique identifier;
• authenticating, by the proxy service or the VPN, the second token;
• and
• injecting, by the proxy service or the VPN, a cookie into a second secure session flow of the second application, wherein the cookie prevents the second application from receiving an interactive authentication request that requests the user input for authentication.

A device comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• sending, from the device within a network, a first request for a first application to access a first service associated with a proxy service or a virtual private network (VPN), wherein the proxy service comprises a multiplexed application substrate over quick user datagram protocol internet connection (QUIC) encryption (MASQUE) proxy service;
• receiving, from the proxy service or the VPN, a first authentication request, the first authentication request including a request for user input;
• generating, by the device, a token, wherein the token is signed using a unique identifier associated with the device;
• sending, to the proxy service or the VPN, a first message including the token;
• establishing, with the proxy service or the VPN and in response to the token being authenticated, a first connection comprising a first secure session flow between the first application and the first service;
• sending, from the device, a second request for a second application to access a second service associated with the proxy service or the VPN, the second application comprising a non-browser application;
• receiving, from the proxy service or the VPN, a second authentication request for proof of possession of the unique identifier, the second authentication request omitting the request for user input;
• sending, to the proxy service or the VPN, a second message including the token;
• and
• establishing, with the proxy service or the VPN and in response to the token being authenticated, a second connection comprising a second secure session flow between the second application and the second service, the first secure session flow and the second secure session flow corresponding to independent session flows.