Using non-routable addressing to reduce attack surface in secure access systems

A device comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, from an application executing on the device, a first request to access a target workload provisioned in a remote network domain;
• determining a network policy associated with the remote network domain;
• identifying, based at least in part on the network policy, a policy rule associated with accessing the target workload provisioned in the remote network domain;
• determining, based at least in part on identifying the policy rule, that the target workload indicated by the first request is associated with the policy rule;
• generating a synthetic internet protocol (IP) address associated with the target workload based at least in part on determining that the target workload is associated with the policy rule;
• storing a first mapping between the synthetic IP address and the target workload;
• receiving a second request to connect to the target workload from the application, the second request indicating the synthetic IP address;
• and
• establishing a first connection between the application and a secure access gateway associated with the target workload based at least in part on the first mapping between the synthetic IP address and the target workload.

A method comprising:

• receiving, at an application on a device, an authentication request to establish a connection between the application and a target workload;
• generating a random domain name associated with the device;
• generating a synthetic internet protocol (IP) address associated with the device, wherein the synthetic IP address is non-routable on the client device;
• storing the synthetic IP address in association with the random domain name;
• causing a loopback listener on the device to listen on the synthetic IP address on a random port;
• invoking an external browser on the device in response to the authentication request, the external browser being redirected to the random domain name and the random port;
• and
• receiving, by the loopback listener, authentication data associated with the authentication request to establish the connection between the application and the target workload.