Next gen zero trust network access (ZTNA) and virtual private network (VPN) including cloud secure access service edge (SASE)

A system comprising:

• a first proxy computer in a first network, a second proxy computer in an enterprise network, the first computer and second computer each including a processor and a memory, both in networked communication with a plurality of security application computers, each security application including a processor and a memory;
• wherein the first proxy computer executes a multiplexed application over QUIC encryption (MASQUE) proxy service in the first network;
• wherein the second proxy computer executes a MASQUE proxy service in the enterprise network;
• wherein at least one of the plurality of security application computers is acting as a policy engine component of the security application, and wherein at least one of the plurality of security application computers is acting as a policy enforcement component of the security application;
• wherein the first proxy computer, the second proxy computer, and the security application computers are each operable to execute instructions stored in the memory, which instructions cause the first proxy computer, the second proxy computer, and the security application computers to perform operations including:
• receiving a connection request from a client device at the first proxy computer for a connection to an application in the enterprise network through a MASQUE proxy tunnel from the first proxy computer to the second proxy computer,
• associating a policy with the connection by the policy engine component of the security application, wherein the policy is associated with at least one of the client device or the application;
• and
• applying the policy, by the at least one policy enforcement component of the security application, to the connection between the client device and the application.

Non-volatile computer-readable media including instructions, which when executed by a system including a first proxy computer in a first network, a second proxy computer in an enterprise network, the first proxy computer and second proxy computer each including a processor and a memory, both in networked communication with a plurality of security application computers, each security application including a processor and a memory;

• wherein the first proxy computer executes a multiplexed application over QUIC encryption (MASQUE) proxy service in the first network;
• wherein the second proxy computer executes a MASQUE proxy service in the enterprise network;
• wherein at least one of the plurality of security application computers is acting as a policy engine component of the security application, and wherein at least one of the plurality of security application computers is acting as a policy enforcement component of the security application;
• wherein the first proxy computer, the second proxy computer, and the security application computers are each operable to execute instructions stored in the memory, which instructions cause the first proxy computer, the second proxy computer, and the security application computers to perform operations including:
• receiving a connection request from a client device at the first proxy computer for a connection to an application in the enterprise network through a MASQUE proxy tunnel from the first proxy computer to the second proxy computer,
• associating a policy with the connection by the policy engine component of the security application, wherein the policy is associated with at least one of the client device or the application;
• and
• applying the policy, by the at least one policy enforcement component of the security application, to the connection between the client device and the application.