Skip to content
SkiMasque
Sign InGet Started

Identity-aware access, built around a real network protocol.

SkiMasque separates the control plane from the network data path.

High-level architecture

  1. Identity
    Policy
    sessionscontrol plane
  2. Gateway
    active
  3. Private network
The control plane decides who may connect; the data plane carries the traffic through the gateway.
  1. Developer or CI/CD
    authenticatecontrol plane
  2. Control planeidentity · policy · sessions
    sessioncontrol plane
  3. Session authorization
    active
  4. MASQUE gateway
    active
  5. Private network
Developers and CI/CD jobs authenticate with the control plane, which authorizes a session; the MASQUE gateway then forwards traffic into the private network.

Control plane

Responsible for:

  • identities
  • authentication
  • policies
  • authorization
  • session issuance
  • gateway management
  • audit records
  • organization configuration

In SkiMasque Cloud, SkiMasque operates the control plane; when you self-host, you do. Either way it is not on the traffic path.

Data plane

Responsible for:

  • network sessions
  • traffic forwarding
  • gateway connectivity
  • protocol handling

The gateway enforces policy itself. If the control plane is unreachable, it keeps enforcing its cached policy.

Why separation matters

The control plane decides:

Should this session exist?

The data plane handles:

How does the traffic move?

A control-plane outage is designed to degrade management, not enforcement.

Read the architecture document