US20180191718A1 - Technologies for securely extending cloud service apis in a cloud service marketplace - Google Patents
Technologies for securely extending cloud service apis in a cloud service marketplace Download PDFInfo
- Publication number
- US20180191718A1 US20180191718A1 US15/393,354 US201615393354A US2018191718A1 US 20180191718 A1 US20180191718 A1 US 20180191718A1 US 201615393354 A US201615393354 A US 201615393354A US 2018191718 A1 US2018191718 A1 US 2018191718A1
- Authority
- US
- United States
- Prior art keywords
- cloud service
- broker
- credentials
- instance
- interface
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/30—Creation or generation of source code
- G06F8/36—Software reuse
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/22—Indexing; Data structures therefor; Storage structures
-
- G06F17/30312—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication
Definitions
- the presently disclosed embodiments generally relate to cloud service marketplaces, and more particularly, to technologies for extending cloud service application programming interfaces (APIs) in cloud service marketplaces.
- APIs application programming interfaces
- ISVs Independent software vendors develop and sell software applications which are typically designed to run on one or more computer hardware or operating system platforms. Such software applications range from basic utility or productivity enhancing application to business process application for enterprises (e.g., customer relationship management (CRM), enterprise resource planning (ERP), automation tools, etc.).
- CRM customer relationship management
- ERP enterprise resource planning
- automation tools etc.
- cloud computing has become more pervasive, one such method of delivering software has been via the cloud using a software as a service (SaaS) based model. Using this delivery method, the ISVs may sell their software applications, or subscriptions to their software applications, through a public cloud or cloud marketplace.
- SaaS software as a service
- a cloud marketplace provides an online storefront that allows customers access to cloud-based services and software applications.
- cloud marketplaces include Amazon's Amazon Web Services® (AWS) Marketplace, Microsoft's Azure® Marketplace, Oracle's Marketplace, Salesforce's AppExchange®, and Ingram Micro's Cloud Marketplace.
- AWS Amazon's Amazon Web Services®
- Azure Microsoft's Azure® Marketplace
- Oracle Microsoft's Marketplace
- Salesforce's AppExchange® Salesforce's AppExchange®
- Ingram Micro's Cloud Marketplace Certain SaaS based subscription services made accessible via a cloud marketplace can be subscribed to and/or used via an application programming interface (API) provided by the ISV that sits between the ISV and the cloud marketplace or other subscription management tool associated with the cloud marketplace.
- API application programming interface
- a cloud service broker may be used to facilitate the transaction between the ISV and an end user, reseller, retailer, etc., by using a plug-in or API connector for each cloud service.
- each cloud service broker typically has a contract with each ISV for each cloud service; however, such an implementation is limited by a maximum number of contracts that can be supported (i.e., limited by the number of cloud services times the number of cloud service brokers).
- Other existing cloud service broker implementations rely on a central entity that will have contracts with each of the cloud service providers and the cloud service brokers; however, in such implementations, maximum number of contracts that can be supported is limited by the number of cloud services plus the number of cloud service brokers.
- only one set of credentials exists for each cloud service API, which are distributed to the cloud service brokers to provide access to the cloud services. Accordingly, the same credentials can be distributed among different cloud service brokers, which can result in one cloud service broker having access to API connectors of other cloud service brokers. There is, therefore, a need for securely extending cloud service APIs in cloud service marketplaces.
- a method for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace includes deploying, by a connector hub of a marketplace computing device, an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmitting, by the connector hub, provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmitting, by the connector hub, broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establishing, by the connector hub, a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein establishing the provisioning channel comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials
- the method further includes generating, by the connector hub, proxy provisioning channel credentials; deploying, by the connector hub, an authentication proxy instance in the connection factory; and transmitting, by the connector hub, the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance.
- establishing the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- establishing the second communication channel between the authentication proxy instance and the cloud service broker interface includes transmitting an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- the method includes generating, by the connector hub, the provider provisioning channel credentials corresponding to the cloud service provider; and generating, by the connector hub, the broker provisioning channel credentials corresponding to the cloud service broker.
- the method includes receiving, by the connector hub, an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein generating the broker provisioning channel credentials for the cloud service broker comprises generating the broker provisioning channel credentials in response to having received the API connector provision notification.
- the method includes receiving, by the connector hub, an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein generating the provider provisioning channel credentials comprises generating the provider provisioning channel credentials in response to having received the indication.
- storing, by the connector hub, the provider provisioning channel credentials in a credentials database of the connector hub associating, by the connector hub, the provider provisioning channel credentials with the cloud service provider in the credentials database; storing, by the connector hub, the broker provisioning channel credentials in the credentials database in the credentials database; and associating, by the connector hub, the broker provisioning channel credentials with a cloud service broker.
- establishing the second communication channel between the API connector instance and the cloud service broker interface includes transmitting an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- one or more computer-readable storage media comprising a plurality of instructions stored thereon that in response to being executed cause a connector hub of a marketplace computing device to deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.
- the one or more computer-readable storage media of claim 9 wherein the plurality of instructions further cause the connector hub to generate proxy provisioning channel credentials; deploy an authentication proxy instance in the connection factory; and transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance, wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- the plurality of instructions further cause the connector hub to generate the provider provisioning channel credentials corresponding to the cloud service provider; and generate the broker provisioning channel credentials corresponding to the cloud service broker. Additionally, in some embodiments, the plurality of instructions further cause the connector hub to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification.
- the plurality of instructions further cause the connector hub to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication.
- the plurality of instructions further cause the connector hub to store the provider provisioning channel credentials in a credentials database of the connector hub; associate the provider provisioning channel credentials with the cloud service provider in the credentials database; store the broker provisioning channel credentials in the credentials database in the credentials database; and associate the broker provisioning channel credentials with a cloud service broker.
- to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- a connector hub of a marketplace computing device for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace
- the cloud service marketplace includes a marketplace computing device, the marketplace computing device comprising a CPU; and a memory having stored therein a plurality of instructions that when executed by the processor cause a connector hub of the marketplace computing device to deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and
- the one or more processors are further configured to execute the instructions to generate proxy provisioning channel credentials; deploy an authentication proxy instance in the connection factory; and transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance, wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- the one or more processors are further configured to execute the instructions to generate the provider provisioning channel credentials corresponding to the cloud service provider; and generate the broker provisioning channel credentials corresponding to the cloud service broker.
- the one or more processors are further configured to execute the instructions to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification.
- the one or more processors are further configured to execute the instructions to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication.
- the one or more processors are further configured to execute the instructions to store the provider provisioning channel credentials in a credentials database of the connector hub; associate the provider provisioning channel credentials with the cloud service provider in the credentials database; store the broker provisioning channel credentials in the credentials database in the credentials database; and associate the broker provisioning channel credentials with a cloud service broker.
- to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- FIG. 1 is a block diagram of an illustrative embodiment of a cloud service marketplace system for securely extending cloud service application programming interfaces (APIs) that includes a broker computing device and a service provider computing device, each of which are communicatively coupled to a marketplace computing device;
- APIs application programming interfaces
- FIG. 2 is a block diagram of multiple provisioning channels having been established between cloud service brokers and cloud service providers of the cloud service marketplace system of FIG. 1 ;
- FIG. 3 is a block diagram of an illustrative embodiment of one of the computing devices of the cloud service broker marketplace of the marketplace computing device of FIG. 1 ;
- FIG. 4 is a schematic flow diagram of an illustrative method for adding a new cloud service to the cloud service marketplace system of FIG. 1 that may be performed by a connector hub of the marketplace computing device of the cloud service marketplace system;
- FIG. 5 is a schematic flow diagram of an illustrative method for establishing a provisioning channel between the cloud service provider and the marketplace computing device of FIG. 1 for a particular cloud service broker that may be performed by a connector hub of the marketplace computing device;
- FIG. 6 is a schematic flow diagram of another illustrative method for establishing a provisioning channel between the cloud service provider and the marketplace computing device of FIG. 1 for a particular cloud service broker that may be performed by a connector hub of the marketplace computing device;
- FIG. 7 is a schematic flow diagram of an illustrative method for configuring a cloud service broker of FIG. 1 for reselling a new service that may be performed by a monitoring agent of the broker computing device of FIG. 1 .
- FIG. 1 illustrates a cloud service marketplace system 100 for securely extending cloud service application programming interfaces (APIs).
- the cloud service marketplace system 100 includes a service provider computing device 118 and a broker computing device 124 , each of which are communicatively coupled to a marketplace computing device 102 (e.g., via a network 132 ).
- the illustrative marketplace computing device 102 includes a connector hub 106 that is configured to establish a provisioning channel (see, e.g., the provisioning channel 140 ) between a cloud service provider interface 120 of the service provider computing device 118 and a cloud service broker interface 126 of the broker computing device 124 to allow a cloud service broker to sell licenses for particular cloud services to end-users (e.g., a customer, a broker, a re-seller, etc.) via their cloud service broker interface 126 .
- a provisioning channel see, e.g., the provisioning channel 140
- end-users e.g., a customer, a broker, a re-seller, etc.
- the connector hub 106 is configured to replicate an instance of an API connector (see, e.g., the API connector instance 116 of the connector factory 112 of FIG. 1 ) corresponding to a cloud service that was previously received from a cloud service provider, generate provisioning channel credentials, and orchestrate the establishment of a provisioning channel (see, e.g., the provisioning channel 140 of FIG. 1 ) between the cloud service provider interface 120 and the cloud service broker interface 126 through the API connector instance using the generated provisioning channel credentials.
- the provisioning channel credentials may be any type of information (e.g., cryptographic keys or other arbitrary data) that is usable to authenticate a secure communication channel between two entities using the provisioning channel credentials.
- the cloud service broker may then resell licenses for that cloud service to end-users via their the cloud service broker interface 126 .
- the illustrative marketplace computing device 102 is configured to securely extend the cloud service APIs by eliminating the exposure of credentials (i.e., credentials specific to a particular cloud service broker or particular cloud service) between cloud service brokers and/or cloud service providers.
- a cloud service provider e.g., an independent software vendor (ISV)
- ISV independent software vendor
- the license may then allow that end-user, or other end-user(s) associated therewith, certain access to the cloud service provider's cloud services (e.g., cloud-based software as a service (SaaS) application(s)).
- the marketplace computing device 102 is configured to manage licenses to various cloud services between cloud service providers and cloud service brokers.
- the cloud service provider develops an API (see, e.g., the API 122 of FIG. 1 ) and an API connector for each of their cloud services, and delivers the API connector and other information of the cloud service (e.g., cloud service address, default settings, pricing information, sales templates, an identifier of the cloud service, etc.) to the connector hub 106 of the marketplace computing device 102 .
- the API connector may be in the form of source code usable to create a replicated instance of that API connector (see, e.g., the API connector instance 116 of the connector factory 112 of FIG. 1 ).
- Each API 122 is configured to receive commands from the cloud service (e.g., via the cloud service provider interface 120 of the service provider computing device 118 ) and transmit the received commands to the API connector instance 116 to which the API is connected, and vice versa. Additionally, each API connector instance 116 is configured to receive/transmit commands to/from the corresponding API 122 to which it is communicatively coupled.
- a cloud service broker i.e., a distributor, reseller, etc. contracts with the controlling entity of the cloud service broker marketplace (see, e.g., the cloud service broker marketplace 104 ) to authorize access to sell/distribute licenses to certain cloud services that are offered in the cloud service broker marketplace 104 .
- the cloud service broker serves as an intermediary between the cloud service marketplace and potential end-users by providing a cloud service portfolio to the end-users that includes each of the cloud services for which that service broker has been authorized to provide, thereby adding a layer of security therebetween.
- the cloud service broker marketplace 104 provides an interface usable to view and select which cloud services the cloud service broker would like to offer for sale. It should be appreciated that the cloud service broker marketplace 104 may only show those cloud services for which the respective cloud service provider has previously provided a corresponding API connector to the connector hub 106 . Accordingly, each cloud service broker may then add available cloud services to their cloud service portfolio by accessing the cloud service broker marketplace 104 .
- the cloud service broker may access the cloud service broker marketplace 104 via the broker computing device 124 , or more particularly, the cloud service broker interface 126 of the broker computing device 124 . In other embodiments, the cloud service broker may access the cloud service broker marketplace 104 via an endpoint computing device 144 communicatively coupled to the cloud service broker marketplace 104 .
- the connector hub 106 is configured to establish the provisioning channel 140 between the cloud service broker interface 126 and the cloud service provider interface 120 . To do so, as will be described in further detail below, the connector hub 106 deploys an API connector instance 116 (i.e., a replicated instance of the API connector received from the cloud service provider) in the connector factory 112 . The connector hub 106 additionally orchestrates the establishment of a series of secure communication channels between the cloud service provider interface 120 (see, e.g., the communication channel 134 ) and the API connector instance 116 , and between the API connector instance 116 and the cloud service broker interface 126 (see, e.g., the communication channel 138 ) using provisioning channel credentials generated by the connector hub 106 .
- an API connector instance 116 i.e., a replicated instance of the API connector received from the cloud service provider
- the connector hub 106 additionally orchestrates the establishment of a series of secure communication channels between the cloud service provider interface 120 (see, e.g., the communication channel 134
- the connector hub 106 is additionally configured to deploy an instance of an authentication proxy 114 (see, e.g., the API connector instance 116 of the connector factory 112 of FIG. 1 ) when the API connector instance 116 is deployed.
- the authentication proxy instance 114 can be deployed in the connector factory 112 between the cloud service broker interface 126 and the API connector instance 116 (i.e., in the communication channel 138 ).
- the connector hub 106 may be further configured to orchestrate the establishment of a secure communication channel (see, e.g., the communication channel 136 ) between the authentication proxy 114 and the API connector instance 116 , such as may be established using provisioning channel credentials.
- the authentication proxy 114 acts as an additional layer of security. Additionally, the authentication proxy 114 can maintain the established connection with the cloud service broker interface 126 , even if the API connector instance 116 has changed. It should be appreciated that one or more of the secure communication channels 134 , 136 , and 138 may be secured using technologies known to those of skill in the art.
- the connector hub 106 may be additionally configured to notify a monitoring agent (see, e.g., the monitoring agent 128 ) of the cloud service broker interface 126 each time a replicated API connector instance 116 associated with that cloud service broker interface 126 is deployed. Accordingly, upon establishing the provisioning channel 140 for that cloud service, end-users associated with the cloud service broker may purchase licenses from the cloud service broker (e.g., via the cloud service broker interface 126 ) for that cloud service.
- a monitoring agent see, e.g., the monitoring agent 128
- end-users associated with the cloud service broker may purchase licenses from the cloud service broker (e.g., via the cloud service broker interface 126 ) for that cloud service.
- the illustrative cloud service broker interfaces 126 includes a first cloud service broker interface, designated as cloud service broker interface (1) 202 , and a second cloud service broker interface, designated as cloud service broker interface (2) 206 .
- the illustrative cloud service broker interface 202 includes a monitoring agent 128 , designated as monitoring agent (1) 204 and the illustrative cloud service broker interface 206 includes a monitoring agent 128 , designated as monitoring agent (2) 208 . It should be appreciated that any number of cloud service broker interfaces 126 may be present in other embodiments.
- the illustrative cloud service provider interfaces 120 includes a first cloud service provider interface, designated as cloud service provider interface (1) 210 , and a second cloud service provider interface, designated as cloud service provider interface (2) 214 .
- each cloud service provider includes an API 122 that is usable to communicate with an API connector instance 116 that is associated with the cloud service to which the API 122 is developed to communicate with.
- the illustrative cloud service provider interface (1) includes a first API, designated as API (1) 212
- the illustrative cloud service provider interface (2) includes a second API, designated as API (2) 216 . It should be appreciated that any number of cloud service provider interfaces 120 may be present in other embodiments. It should be further appreciated that, in other embodiments, each of the cloud service provider interfaces 120 may include multiple APIs 122 .
- the connector hub 106 is configured to establish the provisioning channels 140 between the cloud service provider interfaces 120 and the cloud service broker interfaces 126 by replicating instances of the API connector received from the respective cloud service provider interface 120 that is configured to communicate with the corresponding API 122 .
- the connector hub 106 is configured to establish the provisioning channels 140 between the cloud service provider interfaces 120 and the cloud service broker interfaces 126 by replicating instances of the API connector received from the respective cloud service provider interface 120 that is configured to communicate with the corresponding API 122 .
- four provisioning channels 140 are shown that are each comprised of an API connector instance 116 corresponding to the applicable API 122 to which they are associated and, in some embodiments, an authentication proxy instance 114 .
- the illustrative API connector instances 116 include a first API connector instance, designated as API connector (1) 226 , a second API connector instance, designated as API connector (2) 228 , a third API connector instance, designated as API connector (3) 230 , and a fourth API connector instance, designated as API connector (4) 232 .
- the illustrative authentication proxies 114 include a first authentication proxy instance, designated as authentication proxy (1) 218 , a second authentication proxy instance, designated as authentication proxy (2) 220 , a third authentication proxy instance, designated as authentication proxy (3) 222 , and a fourth authentication proxy instance, designated as authentication proxy (4) 224 .
- each of the four API connectors 116 shown in FIG. 2 are replications of a respective API connector received from the corresponding cloud service provider that are deployed to establish a provisioning channel 140 therebetween.
- API connector (1) 226 and API connector (3) 230 are associated with API (1) 212 of cloud service provider interface (1) 210
- API connector (2) 228 and API connector (4) 232 are associated with API (2) 216 of cloud service provider interface (2) 214 .
- API connector (1) 226 and API connector (2) 228 are associated with cloud service broker interface (1) 202
- API connector (3) 230 and API connector (4) 232 are associated with cloud service broker interface (2) 206 .
- each of the marketplace computing device 102 , the service provider computing device 118 , the broker computing device 124 , and the endpoint computing device 144 may be embodied as any type of computing device 130 .
- each of the respective computing devices 130 may be embodied as any type of compute and/or storage device capable of performing the functions described herein.
- one or more of the respective computing devices 130 may be embodied as a embodied as one or more servers (e.g., stand-alone, rack-mounted, etc.) and/or combination of compute blades and data storage devices (e.g., of a storage area network (SAN)) in a cloud architected network or data center, while one or more of the respective computing devices may be embodied as a desktop computer, a mobile computing device (e.g., smartphones, wearables, tablets, laptops, notebooks, etc.), or any other type of “smart” or otherwise Internet-connected device.
- servers e.g., stand-alone, rack-mounted, etc.
- compute blades and data storage devices e.g., of a storage area network (SAN)
- SAN storage area network
- the illustrative computing device 130 includes a central processing unit (CPU) 300 , an input/output (I/O) controller 302 , a memory 304 , a network communication circuitry 306 , and a data storage device 310 , as well as, in some embodiments, one or more I/O peripherals 308 .
- CPU central processing unit
- I/O input/output
- memory 304 a memory 304
- network communication circuitry 306 a data storage device 310
- one or more I/O peripherals 308 may be combined on a single system-on-a-chip (SoC) on a single integrated circuit (IC).
- SoC system-on-a-chip
- IC integrated circuit
- alternative embodiments may include additional, fewer, and/or alternative components to those of the illustrative computing device 130 , such as a graphics processing unit (GPU), a power supply, etc., which are not shown to preserve clarity of the description. It should be further appreciated that the type of storage/compute components of the respective computing device 130 may be predicated upon the type and intended use of the respective computing device 130 .
- a graphics processing unit GPU
- a power supply etc.
- the CPU 300 may be embodied as any type of hardware or combination of circuitry capable of processing data. Accordingly, the CPU 300 may include one processing core (not shown) in a single-core processor architecture, or multiple processing cores in a multi-core processor architecture. Irrespective of the number of processing cores, the CPU 300 is capable of reading and executing program instructions. In some embodiments, the CPU 300 may include cache memory (not shown) that may be integrated directly with the CPU 300 or placed on a separate chip with a separate interconnect to the CPU 300 . It should be appreciated that, in some embodiments, pipeline logic may be used to perform software and/or hardware operations (e.g., network traffic processing operations), rather than commands issued to/from the CPU 300 .
- software and/or hardware operations e.g., network traffic processing operations
- the I/O controller 302 may be embodied as any type of computer hardware or combination of circuitry capable of interfacing between input/output devices and the computing device 130 .
- the I/O controller 302 is configured to receive input/output requests from the CPU 300 , and send control signals to the respective input/output devices, thereby managing the data flow to/from the computing device 130 .
- the memory 304 may be embodied as any type of computer hardware or combination of circuitry capable of holding data and instructions for processing. Such memory 304 may be referred to as main or primary memory. It should be appreciated that, in some embodiments, one or more components of the computing device 130 may have direct access to memory, such that certain data may be stored via direct memory access (DMA) independently of the CPU 300 .
- DMA direct memory access
- the network communication circuitry 306 may be embodied as any type of computer hardware or combination of circuitry capable of managing network interfacing communications (e.g., messages, datagrams, packets, etc.) via wireless and/or wired communication modes. Accordingly, in some embodiments, the network communication circuitry 306 may include a network interface controller (NIC) capable of being configured to connect the computing device 130 to a computer network (e.g., the network 106 ), as well as other computing devices of the cloud service marketplace system 100 .
- NIC network interface controller
- the one or more I/O peripherals 308 may be embodied as any auxiliary device configured to connect to and communicate with the computing device 130 .
- the I/O peripherals 308 may include, but are not limited to, a mouse, a keyboard, a monitor, a touchscreen, a printer, a scanner, a microphone, a speaker, etc. Accordingly, it should be appreciated that some I/O devices are capable of one function (i.e., input or output), or both functions (i.e., input and output).
- the I/O peripherals 308 may be connected to the computing device 130 via a cable (e.g., a ribbon cable, a wire, a universal serial bus (USB) cable, a high-definition multimedia interface (HDMI) cable, etc.) of the computing device 130 .
- the cable is connected to a corresponding port (not shown) of the computing device 130 for which the communications made therebetween can be managed by the I/O controller 302 .
- the I/O peripherals 308 may be connected to the computing device 130 via a wireless mode of communication (e.g., Bluetooth®, Wi-Fi®, etc.) which can be managed by the network communication circuitry 306 .
- a wireless mode of communication e.g., Bluetooth®, Wi-Fi®, etc.
- the data storage device 310 may be embodied as any type of computer hardware capable of the non-volatile storage of data (e.g., semiconductor storage media, magnetic storage media, optical storage media, etc.). Such data storage devices 310 are commonly referred to as auxiliary or secondary storage, and are typically used to store a large amount of data relative to the memory 304 described above.
- auxiliary or secondary storage Such data storage devices 310 are commonly referred to as auxiliary or secondary storage, and are typically used to store a large amount of data relative to the memory 304 described above.
- the illustrative cloud service marketplace system 100 includes a network 132 that is usable for the other computing devices 130 to communicate with the marketplace computing device 102 .
- the network 132 may be implemented as any type of wired and/or wireless network, including a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a global network (the Internet), etc.
- the network 132 may include one or more communicatively coupled network computing devices (not shown) for facilitating the flow and/or processing of network communication traffic via a series of wired and/or wireless interconnects.
- Such network computing devices may include, but are not limited, to one or more access points, routers, switches, servers, compute devices, storage devices, etc.
- one or more of such network computing devices may be configured to couple the endpoint computing device 144 to the network 132 in a LAN configuration using wired (e.g., Ethernet, token ring, etc.) and/or wireless (e.g., Bluetooth®, Wi-Fi®, wireless broadband, ZigBee®, etc.) communication technologies and associated protocols.
- the LAN may be coupled (e.g., via coaxial, mobile telephony, fiber, etc.) to one or more larger area networks (e.g., WANs, metropolitan area networks (MANs), the Internet, etc.) via additional network computing devices of the network 132 .
- Each of the cloud service provider interface 120 and the cloud service broker interface 126 may be embodied as any combination of software, hardware, firmware, and circuitry capable of performing the functions described herein.
- one or both of the cloud service provider interface 120 and the cloud service broker interface 126 may be configured to render information (e.g., via a user interface (UI)) to a display of the service provider computing device 118 and the broker computing device 114 , respectively.
- the one or both of the cloud service provider interface 120 and the cloud service broker interface 126 may be configured to relay inputs received from a user to login, configure the respective interface, or manipulate information (e.g., settings) associated therewith.
- an illustrative method 400 is provided for adding a new cloud service to a cloud service broker marketplace (e.g., the cloud service broker marketplace 104 of FIG. 1 ) that may be performed by a marketplace computing device (e.g., the marketplace computing device 102 of FIG. 1 ), or more particularly by a connector hub (e.g., the connector hub 106 of FIG. 1 ) of the marketplace computing device 102 .
- the connector hub 106 determines whether a new cloud service is to be added to the available cloud services of the cloud service broker marketplace 104 . Such a determination may be based on whether an indication was received by the connector hub 106 (e.g., from the cloud service provider interface 120 ) that indicates to add the new cloud service to the cloud service broker marketplace 104 .
- the method 400 advances to block 404 .
- the connector hub 106 retrieves an address (e.g., a uniform resource identifier (URI)) associated with the cloud service accessible via a cloud service provider interface (e.g., the cloud service provider interface 120 of FIG. 1 ) of the service provider computing device 118 .
- the connector hub 106 generates provisioning channel credentials (i.e., provider provisioning channel credentials) for the cloud service provider.
- provisioning channel credentials may be received from a cloud service provider (e.g., generated by and received via the cloud service provider interface 120 ).
- the connector hub 106 stores the retrieved cloud service provider address and the provider provisioning channel credentials generated in block 406 to a secure database local to the connector hub 106 (e.g., the credentials database 108 of FIG. 1 ), such as may be secured using technologies known in the art (e.g., a hardware security module).
- the connector hub 106 transmits the provider provisioning channel credentials to the cloud service provider interface 120 .
- the connector hub 106 determines whether an API connector has been received from the cloud service provider (e.g., via the cloud service provider interface 120 ).
- the API connector may be comprised of source code usable to replicate an instance of the API connector.
- addition information related to the API connector may be received with the API connector in block 412 .
- additional information may include an identifier of the API connector.
- the method 400 advances to block 414 , in which the connector hub 106 stores the API connector received in block 412 into a secure database local to the connector hub 106 (e.g., the available services database 110 of FIG. 1 ), such as may be secured using technologies known in the art (e.g., a hardware security module).
- the connector hub 106 stores the source code of the API connector in the available services database 110 . Further, in block 418 , the connector hub stores an identifier of the cloud service associated with the API connector received in block 412 in the available services database 110 .
- illustrative methods 500 , 600 are provided for establishing a provisioning channel (e.g., the provisioning channel 140 of FIG. 1 ) between a cloud service provider interface (e.g., the cloud service provider interface 120 of FIG. 1 ) and a cloud service broker interface (e.g., the cloud service broker interface 126 of FIG. 1 ) that may be performed by the marketplace computing device 102 , or more particularly by a connector hub (e.g., the connector hub 106 of FIG. 1 ) of the marketplace computing device 102 .
- an authentication proxy instance e.g., the authentication proxy instance 114 of FIG. 1
- the illustrative method 500 describes an embodiment in which the authentication proxy instance 114 is deployed in the provisioning channel 140 .
- the illustrative method 600 describes an embodiment in which the authentication proxy instance 114 is not deployed in the provisioning channel 140 .
- the method 500 begins in block 502 , in which the connector hub 106 determines whether an API connector provision notification has been received.
- the API connector provision notification may be received from the cloud service broker marketplace 104 , which was generated in response to a cloud service broker having requested that an available cloud service be added to their cloud service portfolio. If the connector hub 106 determines that an API connector provision notification has been received, the method 500 advances to block 504 .
- the connector hub 106 generates broker provisioning channel credentials for a cloud service broker associated with the API connector provision notification received in block 502 (e.g., based on an identifier of that cloud service broker received with the API connector provision notification in block 502 ). It should be appreciated that the connector hub 106 may be configured to store the generated broker provisioning channel credentials in a credentials database local to the connector hub 106 (e.g., the credentials database 108 of FIG. 1 ). In block 506 , the connector hub 106 transmits the broker provisioning channel credentials to a cloud service broker based on an address of the cloud service broker received with the API connector provision notification. It should be appreciated that the connector hub 106 may be configured to store the cloud service broker address in a database, such as the credentials database 108 . In block 508 , the connector hub 106 generates proxy channel provisioning channel credentials.
- the connector hub 106 deploys an API connector instance (e.g., the API connector instance 116 of FIG. 1 ) based on source code of the API connector retrieved from an available services database (e.g., the available service database 110 of FIG. 1 ) using an identifier of the API connector that was received with the API connector provision notification in block 502 to perform the API connector lookup on the available service database 110 .
- an API connector instance e.g., the API connector instance 116 of FIG. 1
- an available services database e.g., the available service database 110 of FIG. 1
- the connector hub 106 transmits provider provisioning channel information to the API connector instance 116 that is usable to establish the communication channel (e.g., the communication channel 134 of FIG. 1 ) between the cloud service provider interface 120 and the API connector instance 116 .
- provider provisioning channel information includes the provider provisioning channel credentials associated with the cloud service provider to which an identifier of the cloud service corresponds and the address of the cloud service provider.
- the connector hub 106 further transmits proxy provisioning channel information to the API connector instance 116 that is usable to establish the communication channel (e.g., the communication channel 136 of FIG. 1 ) between the API connector instance 116 and an authentication proxy instance.
- proxy channel provisioning information includes the proxy channel provisioning channel credentials.
- the connector hub 106 deploys an authentication proxy instance (e.g., the authentication proxy instance 114 of FIG. 1 ). Additionally, in block 516 , the connector hub 106 transmits broker provisioning channel information to the authentication proxy instance 114 that is usable to establish the communication channel between the authentication proxy instance 114 and the cloud service broker interface 126 (e.g., the communication channel 138 of FIG. 1 ).
- broker provisioning channel information includes the broker provisioning channel credentials associated with the cloud service broker to which the cloud service broker identifier corresponds and the address of the cloud service broker.
- the connector hub 106 in block 516 , further transmits proxy provisioning channel credentials to the authentication proxy instance 114 that are usable to establish the communication channel between the API connector instance 116 and the authentication proxy instance 114 (e.g., the communication channel 136 of FIG. 1 ).
- the connector hub 106 establishes a portion of the provisioning channel 140 between the cloud service provider interface 120 and the authentication proxy instance 114 . To do so, in block 520 , the connector hub 106 establishes the communication channel 134 between the API connector instance 116 and the cloud service provider interface 120 using the provider provisioning channel credentials. Additionally, in block 522 , the connector hub 106 establishes the communication channel 136 between the API connector instance 116 and the authentication proxy instance 114 using the proxy provisioning channel credentials (i.e., to verify to each other entity that they are who they claim to be) using any authentication operation(s) known to those of skill in the art.
- the proxy provisioning channel credentials i.e., to verify to each other entity that they are who they claim to be
- the connector hub 106 transmits a message that includes an address (e.g., a URI) of the API connector instance 116 , which is usable to establish a communication channel (e.g., the communication channel 138 ) between the authentication proxy instance 114 and the cloud service broker interface 126 .
- the message indicating the authentication proxy instance 114 has been deployed may be placed in a message queue from which the notifications are either pushed by the connector hub 106 or pulled by the cloud service broker interface 126 .
- a monitoring agent (e.g., the monitoring agent 128 of FIG. 1 ) may have been previously deployed on a cloud service broker (e.g., the cloud service broker interface 126 ) that is usable to receive/retrieve the indication.
- the monitoring agent 128 may initiate the establishment of the communication channel 138 between the cloud service broker interface 126 and the authentication proxy instance 114 using the broker provisioning channel credentials (see, e.g., the method 700 of FIG. 7 ).
- the indication includes an address (e.g., in a URI) of the authentication proxy instance 114 deployed in block 608 that usable by the monitoring agent 128 to establish the communication channel 138 and complete the provisioning channel 140 .
- the configuration of the communication channel 138 may be performed manually at the cloud service broker interface 126 .
- a communication channel 134 is established between the cloud service provider interface (1) 210 and the cloud service broker interface (1) 202 .
- the API connector (1) 226 establishes the communication channel 134 with the cloud service provider interface (1) 210 , via the API (1) 212 , by performing an authentication operation using the provider provisioning channel credentials previously transmitted to the API connector (1) 226 and the cloud service provider interface (1) 210 .
- another communication channel 134 is established between the cloud service provider interface (2) 214 and the cloud service broker interface (1) 202 .
- the API connector (1) 228 establishes the communication channel 134 with the cloud service provider interface (2) 214 , via the API (2) 216 , by performing an authentication operation using the provider provisioning channel credentials previously provided to the API connector (1) 228 and the cloud service provider interface (2) 214 .
- a communication channel 136 is established between the API connector (1) 226 and the authentication proxy (1) 218 by performing an authentication operation using the proxy provisioning channel credentials associated with the API connector (1) 226 and the authentication proxy (1) 218 .
- another communication channel 136 is established between the API connector (2) 228 and the authentication proxy (2) 220 by performing an authentication operation using the proxy provisioning channel credentials associated with the API connector (2) 228 and the authentication proxy (2) 220 .
- a communication channel 138 is established between the cloud service broker interface (1) 202 and the authentication proxy (1) 218 .
- the cloud service broker interface (1) 202 and the authentication proxy (1) 218 perform an authentication operation using the broker provisioning channel credentials previously provided to the cloud service broker interface (1) 202 and the authentication proxy (1) 218 .
- another communication channel 138 is established between the cloud service broker interface (1) 202 and the authentication proxy (2) 220 .
- the cloud service broker interface (1) 202 and the authentication proxy (2) 220 perform an authentication operation using the broker provisioning channel credentials previously provided to the cloud service broker interface (1) 202 and the authentication proxy (2) 220 .
- an authentication proxy instance 114 may not be deployed in some embodiments.
- the communication channel 138 extends from the respective cloud service broker interface 126 directly to the respective API connector instance 116 . Irrespective of whether the authentication proxy instance 114 is deployed in the provisioning channel or not, unlike present technologies, neither the cloud service provider interfaces 120 nor the cloud service broker interfaces 126 have access to the other's provisioning channel credentials, thereby providing a secure extension of the respective APIs 122 of cloud service providers.
- the method 600 begins in block 602 , in which the connector hub 106 determines whether an API connector provision notification has been received.
- the API connector provision notification may be received from the cloud service broker marketplace 104 , which was generated in response to a cloud service broker having requested that an available cloud service be added to their cloud service portfolio. If the connector hub 106 determines that an API connector provision notification has been received, the method 600 advances to block 604 .
- the connector hub 106 generates broker provisioning channel credentials for a cloud service broker associated with the API connector provision notification received in block 602 (e.g., based on an identifier of that cloud service broker received with the API connector provision notification in block 602 ). It should be appreciated that the connector hub 106 may be configured to store the generated broker provisioning channel credentials in a credentials database local to the connector hub 106 (e.g., in the credentials database 108 of FIG. 1 ). It should be further appreciated that, in some embodiments, the broker provisioning channel credentials may be received from a cloud service broker (e.g., generated by and received via the cloud service broker interface 126 ).
- the connector hub 106 transmits the broker provisioning channel credentials to a cloud service broker based on an address of the cloud service broker received with the API connector provision notification. It should be appreciated that the connector hub 106 may be configured to store the cloud service broker address in a database, such as the credentials database 108 .
- the connector hub 106 deploys an API connector instance (e.g., the API connector instance 116 of FIG. 1 ) based on source code of the API connector retrieved from an available services database (e.g., the available service database 110 of FIG. 1 ) using an identifier of the API connector that was received with the API connector provision notification in block 602 to perform the API connector lookup on the available service database 110 .
- the connector hub 106 transmits provider provisioning channel information to the API connector instance 116 that is usable to establish the communication channel (e.g., the communication channel 134 of FIG. 1 ) between the cloud service provider interface 120 and the API connector instance 116 .
- provider provisioning channel information includes the provider provisioning channel credentials associated with the cloud service provider to which an identifier of the cloud service corresponds and the address of the cloud service provider.
- the connector hub 106 transmits broker provisioning channel information to the API connector instance 116 that is usable to establish a communication channel between the API connector instance 116 and the cloud service broker interface 126 (e.g., the communication channel 138 of FIG. 1 ).
- broker provisioning channel information includes the broker provisioning channel credentials associated with the cloud service broker to which the cloud service broker identifier corresponds and the address of the cloud service broker.
- the connector hub 106 establishes a provisioning channel between the cloud service provider interface 120 and the cloud service broker interface 126 . To do so, in block 616 , the connector hub 106 establishes the communication channel 134 between the API connector instance 116 and the cloud service provider interface 120 using the provider provisioning channel credentials. Additionally, in block 618 , the connector hub 106 establishes communication channel 138 between the API connector instance 116 and the cloud service broker interface 126 using the broker provisioning channel credentials.
- the connector hub 106 transmits a message that includes an address (e.g., a URI) of the API connector instance 116 , which is usable to establish a communication channel (e.g., the communication channel 138 ) between the API connector instance 116 and the cloud service broker interface 126 .
- the message indicating the API connector instance 116 has been deployed may be placed in a message queue from which the notifications are either pushed by the connector hub 106 or pulled by the cloud service broker interface 126 .
- a monitoring agent (e.g., the monitoring agent 128 of FIG. 1 ) may have been previously deployed on a cloud service broker (e.g., the cloud service broker interface 126 ) that is usable to receive/retrieve the indication.
- the monitoring agent 128 may initiate the establishment of the communication channel 138 between the cloud service broker interface 126 and the API connector instance 116 using the broker provisioning channel credentials (see, e.g., the method 700 of FIG. 7 ).
- the indication includes an address of the API connector instance 116 (e.g., in a URI) deployed in block 608 that usable by the monitoring agent 128 to establish the communication channel 138 and complete the provisioning channel 140 .
- the configuration of the communication channel 138 may be performed manually at the cloud service broker interface 126 .
- an illustrative method 700 is provided for configuring a cloud service for resale by a cloud service broker that may be performed by a cloud service broker interface of a broker computing device (e.g., the cloud service broker interface 126 of the broker computing device 124 of FIG. 1 ), or more particularly by a monitoring agent (e.g., the monitoring agent 128 of FIG. 1 ) of the cloud service broker interface 126 .
- the method 600 begins in block 702 , in which the monitoring agent 128 determines whether a new API connector instance (e.g., the API connector instance 116 ) has been detected.
- source code of an API connector i.e., used to deploy an API connector instance 116
- the connector hub 106 is configured to deploy new instances of the API connector.
- the communication channel 136 may be re-stablished without additional configuration.
- the monitoring channel 142 may be established between the monitoring agent 128 and the connector hub 106 to transmit messages therebetween. Such messages include messages that indicate the health (e.g., quality of service) of the communication channel 136 , as well as message which indicate that a new API connector instance 116 is available, thereby triggering the method 700 .
- a new authentication proxy instance 114 may be deployed and/or the broker provisioning channel credentials changed.
- connector hub 106 is configured notify the cloud service broker interface 126 of the new authentication proxy instance 114 and/or the new broker provisioning channel credentials.
- one of the methods 500 , 600 may be used to re-establish the communication channel 138 .
- such notification may be performed via a monitoring channel (see, e.g., the monitoring channel 142 of FIG. 1 ) between the monitoring agent 128 and the connector hub 106 .
- the method 700 advances to block 704 .
- the monitoring agent 128 configures a communication channel (e.g., the communication channel 138 of the provisioning channel 140 ) with the new API connector instance 116 that was detected in block 702 .
- the monitoring agent 128 configures the communication channel 138 based on a URI of an authentication proxy instance (e.g., the authentication proxy instance 114 of FIG. 1 ) that is associated with the new API connector instance 116 .
- the monitoring agent 128 configures the communication channel 138 based on a URI that includes information usable to establish the communication channel with the new API connector instance 116 .
- the monitoring agent 128 configures the cloud service broker interface 126 to allow resale of the cloud service associated with the new API connector instance 114 .
- the monitoring agent 128 configures the cloud service broker interface 126 based on default settings received from the connector hub 106 (e.g., via the monitoring channel 142 ).
- the default settings may include sales plans, service templates, pricing models, descriptions, etc. It should be appreciated that the settings may be changed by the cloud service broker (e.g., via the cloud service broker interface 126 ) upon completion of the initial configuration performed in block 710 .
- the monitoring agent 128 may have not been deployed prior to the method 700 being performed.
- the cloud service broker marketplace 104 may be configured to provide an indication to the cloud service interface broker 126 to deploy the monitoring agent 128 .
- Such an indication may include information usable to initially configure the monitoring agent 128 , as well as information usable by the monitoring agent 128 to monitor the health of communication channel 138 .
- the monitoring agent 128 may then monitor the health of communication channel 138 and report to the connector hub 106 results of the monitoring operation.
Abstract
Description
- The presently disclosed embodiments generally relate to cloud service marketplaces, and more particularly, to technologies for extending cloud service application programming interfaces (APIs) in cloud service marketplaces.
- Independent software vendors (ISVs) develop and sell software applications which are typically designed to run on one or more computer hardware or operating system platforms. Such software applications range from basic utility or productivity enhancing application to business process application for enterprises (e.g., customer relationship management (CRM), enterprise resource planning (ERP), automation tools, etc.). As cloud computing has become more pervasive, one such method of delivering software has been via the cloud using a software as a service (SaaS) based model. Using this delivery method, the ISVs may sell their software applications, or subscriptions to their software applications, through a public cloud or cloud marketplace.
- A cloud marketplace provides an online storefront that allows customers access to cloud-based services and software applications. Such examples of cloud marketplaces include Amazon's Amazon Web Services® (AWS) Marketplace, Microsoft's Azure® Marketplace, Oracle's Marketplace, Salesforce's AppExchange®, and Ingram Micro's Cloud Marketplace. Certain SaaS based subscription services made accessible via a cloud marketplace can be subscribed to and/or used via an application programming interface (API) provided by the ISV that sits between the ISV and the cloud marketplace or other subscription management tool associated with the cloud marketplace. In such configurations, a cloud service broker may be used to facilitate the transaction between the ISV and an end user, reseller, retailer, etc., by using a plug-in or API connector for each cloud service.
- In traditional cloud service broker implementations, each cloud service broker typically has a contract with each ISV for each cloud service; however, such an implementation is limited by a maximum number of contracts that can be supported (i.e., limited by the number of cloud services times the number of cloud service brokers). Other existing cloud service broker implementations rely on a central entity that will have contracts with each of the cloud service providers and the cloud service brokers; however, in such implementations, maximum number of contracts that can be supported is limited by the number of cloud services plus the number of cloud service brokers. Further, in such implementations only one set of credentials exists for each cloud service API, which are distributed to the cloud service brokers to provide access to the cloud services. Accordingly, the same credentials can be distributed among different cloud service brokers, which can result in one cloud service broker having access to API connectors of other cloud service brokers. There is, therefore, a need for securely extending cloud service APIs in cloud service marketplaces.
- In one aspect, a method for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace includes deploying, by a connector hub of a marketplace computing device, an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmitting, by the connector hub, provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmitting, by the connector hub, broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establishing, by the connector hub, a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein establishing the provisioning channel comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.
- In some embodiments, the method further includes generating, by the connector hub, proxy provisioning channel credentials; deploying, by the connector hub, an authentication proxy instance in the connection factory; and transmitting, by the connector hub, the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance. In other embodiments, establishing the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- In other embodiments, establishing the second communication channel between the authentication proxy instance and the cloud service broker interface includes transmitting an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- In still other embodiments, the method includes generating, by the connector hub, the provider provisioning channel credentials corresponding to the cloud service provider; and generating, by the connector hub, the broker provisioning channel credentials corresponding to the cloud service broker. In yet other embodiments, the method includes receiving, by the connector hub, an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein generating the broker provisioning channel credentials for the cloud service broker comprises generating the broker provisioning channel credentials in response to having received the API connector provision notification.
- In some embodiments, the method includes receiving, by the connector hub, an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein generating the provider provisioning channel credentials comprises generating the provider provisioning channel credentials in response to having received the indication. In other embodiments, storing, by the connector hub, the provider provisioning channel credentials in a credentials database of the connector hub; associating, by the connector hub, the provider provisioning channel credentials with the cloud service provider in the credentials database; storing, by the connector hub, the broker provisioning channel credentials in the credentials database in the credentials database; and associating, by the connector hub, the broker provisioning channel credentials with a cloud service broker. In still other embodiments, establishing the second communication channel between the API connector instance and the cloud service broker interface includes transmitting an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- In another aspect, one or more computer-readable storage media comprising a plurality of instructions stored thereon that in response to being executed cause a connector hub of a marketplace computing device to deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.
- In some embodiments, the one or more computer-readable storage media of claim 9, wherein the plurality of instructions further cause the connector hub to generate proxy provisioning channel credentials; deploy an authentication proxy instance in the connection factory; and transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance, wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- In other embodiments, to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- In still other embodiments the plurality of instructions further cause the connector hub to generate the provider provisioning channel credentials corresponding to the cloud service provider; and generate the broker provisioning channel credentials corresponding to the cloud service broker. Additionally, in some embodiments, the plurality of instructions further cause the connector hub to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification. Additionally or alternatively, in other embodiments, the plurality of instructions further cause the connector hub to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication.
- In some embodiments, the plurality of instructions further cause the connector hub to store the provider provisioning channel credentials in a credentials database of the connector hub; associate the provider provisioning channel credentials with the cloud service provider in the credentials database; store the broker provisioning channel credentials in the credentials database in the credentials database; and associate the broker provisioning channel credentials with a cloud service broker. In other embodiments, to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- In still another aspect, a connector hub of a marketplace computing device for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, wherein the cloud service marketplace includes a marketplace computing device, the marketplace computing device comprising a CPU; and a memory having stored therein a plurality of instructions that when executed by the processor cause a connector hub of the marketplace computing device to deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.
- In some embodiments, the one or more processors are further configured to execute the instructions to generate proxy provisioning channel credentials; deploy an authentication proxy instance in the connection factory; and transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance, wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.
- In other embodiments, to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. In still other embodiments, the one or more processors are further configured to execute the instructions to generate the provider provisioning channel credentials corresponding to the cloud service provider; and generate the broker provisioning channel credentials corresponding to the cloud service broker. In some embodiments, the one or more processors are further configured to execute the instructions to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification.
- In other embodiments, the one or more processors are further configured to execute the instructions to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication. In still other embodiments, the one or more processors are further configured to execute the instructions to store the provider provisioning channel credentials in a credentials database of the connector hub; associate the provider provisioning channel credentials with the cloud service provider in the credentials database; store the broker provisioning channel credentials in the credentials database in the credentials database; and associate the broker provisioning channel credentials with a cloud service broker. In yet still other embodiments, to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.
- The embodiments and other features, advantages and disclosures contained herein, and the manner of attaining them, will become apparent and the present disclosure will be better understood by reference to the following description of various exemplary embodiments of the present disclosure taken in conjunction with the accompanying drawings, wherein:
-
FIG. 1 is a block diagram of an illustrative embodiment of a cloud service marketplace system for securely extending cloud service application programming interfaces (APIs) that includes a broker computing device and a service provider computing device, each of which are communicatively coupled to a marketplace computing device; -
FIG. 2 is a block diagram of multiple provisioning channels having been established between cloud service brokers and cloud service providers of the cloud service marketplace system ofFIG. 1 ; -
FIG. 3 is a block diagram of an illustrative embodiment of one of the computing devices of the cloud service broker marketplace of the marketplace computing device ofFIG. 1 ; -
FIG. 4 is a schematic flow diagram of an illustrative method for adding a new cloud service to the cloud service marketplace system ofFIG. 1 that may be performed by a connector hub of the marketplace computing device of the cloud service marketplace system; -
FIG. 5 is a schematic flow diagram of an illustrative method for establishing a provisioning channel between the cloud service provider and the marketplace computing device ofFIG. 1 for a particular cloud service broker that may be performed by a connector hub of the marketplace computing device; -
FIG. 6 is a schematic flow diagram of another illustrative method for establishing a provisioning channel between the cloud service provider and the marketplace computing device ofFIG. 1 for a particular cloud service broker that may be performed by a connector hub of the marketplace computing device; and -
FIG. 7 is a schematic flow diagram of an illustrative method for configuring a cloud service broker ofFIG. 1 for reselling a new service that may be performed by a monitoring agent of the broker computing device ofFIG. 1 . - For the purposes of promoting an understanding of the principles of the present disclosure, reference will now be made to the embodiments illustrated in the drawings, and specific language will be used to describe the same. It will nevertheless be understood that no limitation of the scope of this disclosure is thereby intended.
-
FIG. 1 illustrates a cloudservice marketplace system 100 for securely extending cloud service application programming interfaces (APIs). The cloudservice marketplace system 100 includes a serviceprovider computing device 118 and abroker computing device 124, each of which are communicatively coupled to a marketplace computing device 102 (e.g., via a network 132). The illustrativemarketplace computing device 102 includes aconnector hub 106 that is configured to establish a provisioning channel (see, e.g., the provisioning channel 140) between a cloudservice provider interface 120 of the serviceprovider computing device 118 and a cloudservice broker interface 126 of thebroker computing device 124 to allow a cloud service broker to sell licenses for particular cloud services to end-users (e.g., a customer, a broker, a re-seller, etc.) via their cloudservice broker interface 126. - To do so, as will be described in further detail below, the
connector hub 106 is configured to replicate an instance of an API connector (see, e.g., theAPI connector instance 116 of theconnector factory 112 ofFIG. 1 ) corresponding to a cloud service that was previously received from a cloud service provider, generate provisioning channel credentials, and orchestrate the establishment of a provisioning channel (see, e.g., theprovisioning channel 140 ofFIG. 1 ) between the cloudservice provider interface 120 and the cloudservice broker interface 126 through the API connector instance using the generated provisioning channel credentials. It should be appreciated that the provisioning channel credentials may be any type of information (e.g., cryptographic keys or other arbitrary data) that is usable to authenticate a secure communication channel between two entities using the provisioning channel credentials. - Subsequent to the
provisioning channel 140 having been established, the cloud service broker may then resell licenses for that cloud service to end-users via their the cloudservice broker interface 126. Accordingly, unlike present technologies in which the API connectors, and therefore the credentials of each cloud service broker, are managed by the cloud service brokers, the illustrativemarketplace computing device 102 is configured to securely extend the cloud service APIs by eliminating the exposure of credentials (i.e., credentials specific to a particular cloud service broker or particular cloud service) between cloud service brokers and/or cloud service providers. - In an illustrative example, a cloud service provider (e.g., an independent software vendor (ISV)) contracts with a controlling entity of a cloud service marketplace to facilitate the sale of a license to an end-user. The license may then allow that end-user, or other end-user(s) associated therewith, certain access to the cloud service provider's cloud services (e.g., cloud-based software as a service (SaaS) application(s)). In the illustrative cloud
service marketplace system 100, themarketplace computing device 102 is configured to manage licenses to various cloud services between cloud service providers and cloud service brokers. - In use, the cloud service provider develops an API (see, e.g., the
API 122 ofFIG. 1 ) and an API connector for each of their cloud services, and delivers the API connector and other information of the cloud service (e.g., cloud service address, default settings, pricing information, sales templates, an identifier of the cloud service, etc.) to theconnector hub 106 of themarketplace computing device 102. In some embodiments, the API connector may be in the form of source code usable to create a replicated instance of that API connector (see, e.g., theAPI connector instance 116 of theconnector factory 112 ofFIG. 1 ). EachAPI 122 is configured to receive commands from the cloud service (e.g., via the cloudservice provider interface 120 of the service provider computing device 118) and transmit the received commands to theAPI connector instance 116 to which the API is connected, and vice versa. Additionally, eachAPI connector instance 116 is configured to receive/transmit commands to/from the correspondingAPI 122 to which it is communicatively coupled. - In furtherance of the illustrative example, a cloud service broker (i.e., a distributor, reseller, etc.) contracts with the controlling entity of the cloud service broker marketplace (see, e.g., the cloud service broker marketplace 104) to authorize access to sell/distribute licenses to certain cloud services that are offered in the cloud
service broker marketplace 104. In other words, the cloud service broker serves as an intermediary between the cloud service marketplace and potential end-users by providing a cloud service portfolio to the end-users that includes each of the cloud services for which that service broker has been authorized to provide, thereby adding a layer of security therebetween. - To offer the available cloud services to the cloud service brokers, the cloud
service broker marketplace 104 provides an interface usable to view and select which cloud services the cloud service broker would like to offer for sale. It should be appreciated that the cloudservice broker marketplace 104 may only show those cloud services for which the respective cloud service provider has previously provided a corresponding API connector to theconnector hub 106. Accordingly, each cloud service broker may then add available cloud services to their cloud service portfolio by accessing the cloudservice broker marketplace 104. In some embodiments, the cloud service broker may access the cloudservice broker marketplace 104 via thebroker computing device 124, or more particularly, the cloudservice broker interface 126 of thebroker computing device 124. In other embodiments, the cloud service broker may access the cloudservice broker marketplace 104 via anendpoint computing device 144 communicatively coupled to the cloudservice broker marketplace 104. - As described previously, the
connector hub 106 is configured to establish theprovisioning channel 140 between the cloudservice broker interface 126 and the cloudservice provider interface 120. To do so, as will be described in further detail below, theconnector hub 106 deploys an API connector instance 116 (i.e., a replicated instance of the API connector received from the cloud service provider) in theconnector factory 112. Theconnector hub 106 additionally orchestrates the establishment of a series of secure communication channels between the cloud service provider interface 120 (see, e.g., the communication channel 134) and theAPI connector instance 116, and between theAPI connector instance 116 and the cloud service broker interface 126 (see, e.g., the communication channel 138) using provisioning channel credentials generated by theconnector hub 106. - In some embodiments, the
connector hub 106 is additionally configured to deploy an instance of an authentication proxy 114 (see, e.g., theAPI connector instance 116 of theconnector factory 112 ofFIG. 1 ) when theAPI connector instance 116 is deployed. In such embodiments, theauthentication proxy instance 114 can be deployed in theconnector factory 112 between the cloudservice broker interface 126 and the API connector instance 116 (i.e., in the communication channel 138). Additionally, in such embodiments, theconnector hub 106 may be further configured to orchestrate the establishment of a secure communication channel (see, e.g., the communication channel 136) between theauthentication proxy 114 and theAPI connector instance 116, such as may be established using provisioning channel credentials. Accordingly, in such embodiments, theauthentication proxy 114 acts as an additional layer of security. Additionally, theauthentication proxy 114 can maintain the established connection with the cloudservice broker interface 126, even if theAPI connector instance 116 has changed. It should be appreciated that one or more of thesecure communication channels - In some embodiments, the
connector hub 106 may be additionally configured to notify a monitoring agent (see, e.g., the monitoring agent 128) of the cloudservice broker interface 126 each time a replicatedAPI connector instance 116 associated with that cloudservice broker interface 126 is deployed. Accordingly, upon establishing theprovisioning channel 140 for that cloud service, end-users associated with the cloud service broker may purchase licenses from the cloud service broker (e.g., via the cloud service broker interface 126) for that cloud service. - Referring now to
FIG. 2 ,multiple provisioning channels 140 are shown as having been established between more than one cloud service broker interfaces and more than one cloud service providers of the cloudservice marketplace system 100 ofFIG. 1 . The illustrative cloud service broker interfaces 126 includes a first cloud service broker interface, designated as cloud service broker interface (1) 202, and a second cloud service broker interface, designated as cloud service broker interface (2) 206. The illustrative cloudservice broker interface 202 includes amonitoring agent 128, designated as monitoring agent (1) 204 and the illustrative cloudservice broker interface 206 includes amonitoring agent 128, designated as monitoring agent (2) 208. It should be appreciated that any number of cloud service broker interfaces 126 may be present in other embodiments. - The illustrative cloud service provider interfaces 120 includes a first cloud service provider interface, designated as cloud service provider interface (1) 210, and a second cloud service provider interface, designated as cloud service provider interface (2) 214. As described previously, each cloud service provider includes an
API 122 that is usable to communicate with anAPI connector instance 116 that is associated with the cloud service to which theAPI 122 is developed to communicate with. The illustrative cloud service provider interface (1) includes a first API, designated as API (1) 212, and the illustrative cloud service provider interface (2) includes a second API, designated as API (2) 216. It should be appreciated that any number of cloud service provider interfaces 120 may be present in other embodiments. It should be further appreciated that, in other embodiments, each of the cloud service provider interfaces 120 may includemultiple APIs 122. - As described previously, the
connector hub 106 is configured to establish theprovisioning channels 140 between the cloud service provider interfaces 120 and the cloud service broker interfaces 126 by replicating instances of the API connector received from the respective cloudservice provider interface 120 that is configured to communicate with the correspondingAPI 122. In theillustrative connector factory 112, fourprovisioning channels 140 are shown that are each comprised of anAPI connector instance 116 corresponding to theapplicable API 122 to which they are associated and, in some embodiments, anauthentication proxy instance 114. - The illustrative
API connector instances 116 include a first API connector instance, designated as API connector (1) 226, a second API connector instance, designated as API connector (2) 228, a third API connector instance, designated as API connector (3) 230, and a fourth API connector instance, designated as API connector (4) 232. Theillustrative authentication proxies 114 include a first authentication proxy instance, designated as authentication proxy (1) 218, a second authentication proxy instance, designated as authentication proxy (2) 220, a third authentication proxy instance, designated as authentication proxy (3) 222, and a fourth authentication proxy instance, designated as authentication proxy (4) 224. - It should be appreciated that each of the four
API connectors 116 shown inFIG. 2 (i.e.,API connectors instances provisioning channel 140 therebetween. As shown, API connector (1) 226 and API connector (3) 230 are associated with API (1) 212 of cloud service provider interface (1) 210, while API connector (2) 228 and API connector (4) 232 are associated with API (2) 216 of cloud service provider interface (2) 214. Additionally, API connector (1) 226 and API connector (2) 228 are associated with cloud service broker interface (1) 202, while API connector (3) 230 and API connector (4) 232 are associated with cloud service broker interface (2) 206. - Referring back to
FIG. 1 , as shown in the illustrative cloudservice marketplace system 100, each of themarketplace computing device 102, the serviceprovider computing device 118, thebroker computing device 124, and theendpoint computing device 144 may be embodied as any type ofcomputing device 130. In other words, each of therespective computing devices 130 may be embodied as any type of compute and/or storage device capable of performing the functions described herein. It should be appreciated that one or more of therespective computing devices 130 may be embodied as a embodied as one or more servers (e.g., stand-alone, rack-mounted, etc.) and/or combination of compute blades and data storage devices (e.g., of a storage area network (SAN)) in a cloud architected network or data center, while one or more of the respective computing devices may be embodied as a desktop computer, a mobile computing device (e.g., smartphones, wearables, tablets, laptops, notebooks, etc.), or any other type of “smart” or otherwise Internet-connected device. - Referring now to
FIG. 3 , an illustrative embodiment of acomputing device 130 representative of one or more of themarketplace computing device 102, the serviceprovider computing device 118, thebroker computing device 124, and theendpoint computing device 144 is shown. Theillustrative computing device 130 includes a central processing unit (CPU) 300, an input/output (I/O)controller 302, amemory 304, anetwork communication circuitry 306, and adata storage device 310, as well as, in some embodiments, one or more I/O peripherals 308. In some embodiments, one or more of the illustrative components may be combined on a single system-on-a-chip (SoC) on a single integrated circuit (IC). It should be appreciated that alternative embodiments may include additional, fewer, and/or alternative components to those of theillustrative computing device 130, such as a graphics processing unit (GPU), a power supply, etc., which are not shown to preserve clarity of the description. It should be further appreciated that the type of storage/compute components of therespective computing device 130 may be predicated upon the type and intended use of therespective computing device 130. - The
CPU 300, or processor, may be embodied as any type of hardware or combination of circuitry capable of processing data. Accordingly, theCPU 300 may include one processing core (not shown) in a single-core processor architecture, or multiple processing cores in a multi-core processor architecture. Irrespective of the number of processing cores, theCPU 300 is capable of reading and executing program instructions. In some embodiments, theCPU 300 may include cache memory (not shown) that may be integrated directly with theCPU 300 or placed on a separate chip with a separate interconnect to theCPU 300. It should be appreciated that, in some embodiments, pipeline logic may be used to perform software and/or hardware operations (e.g., network traffic processing operations), rather than commands issued to/from theCPU 300. - The I/
O controller 302, or I/O interface, may be embodied as any type of computer hardware or combination of circuitry capable of interfacing between input/output devices and thecomputing device 130. Illustratively, the I/O controller 302 is configured to receive input/output requests from theCPU 300, and send control signals to the respective input/output devices, thereby managing the data flow to/from thecomputing device 130. - The
memory 304 may be embodied as any type of computer hardware or combination of circuitry capable of holding data and instructions for processing.Such memory 304 may be referred to as main or primary memory. It should be appreciated that, in some embodiments, one or more components of thecomputing device 130 may have direct access to memory, such that certain data may be stored via direct memory access (DMA) independently of theCPU 300. - The
network communication circuitry 306 may be embodied as any type of computer hardware or combination of circuitry capable of managing network interfacing communications (e.g., messages, datagrams, packets, etc.) via wireless and/or wired communication modes. Accordingly, in some embodiments, thenetwork communication circuitry 306 may include a network interface controller (NIC) capable of being configured to connect thecomputing device 130 to a computer network (e.g., the network 106), as well as other computing devices of the cloudservice marketplace system 100. - The one or more I/
O peripherals 308 may be embodied as any auxiliary device configured to connect to and communicate with thecomputing device 130. For example, the I/O peripherals 308 may include, but are not limited to, a mouse, a keyboard, a monitor, a touchscreen, a printer, a scanner, a microphone, a speaker, etc. Accordingly, it should be appreciated that some I/O devices are capable of one function (i.e., input or output), or both functions (i.e., input and output). - In some embodiments, the I/
O peripherals 308 may be connected to thecomputing device 130 via a cable (e.g., a ribbon cable, a wire, a universal serial bus (USB) cable, a high-definition multimedia interface (HDMI) cable, etc.) of thecomputing device 130. In such embodiments, the cable is connected to a corresponding port (not shown) of thecomputing device 130 for which the communications made therebetween can be managed by the I/O controller 302. In alternative embodiments, the I/O peripherals 308 may be connected to thecomputing device 130 via a wireless mode of communication (e.g., Bluetooth®, Wi-Fi®, etc.) which can be managed by thenetwork communication circuitry 306. - The
data storage device 310 may be embodied as any type of computer hardware capable of the non-volatile storage of data (e.g., semiconductor storage media, magnetic storage media, optical storage media, etc.). Suchdata storage devices 310 are commonly referred to as auxiliary or secondary storage, and are typically used to store a large amount of data relative to thememory 304 described above. - Referring back to
FIG. 1 , the illustrative cloudservice marketplace system 100 includes anetwork 132 that is usable for theother computing devices 130 to communicate with themarketplace computing device 102. Thenetwork 132 may be implemented as any type of wired and/or wireless network, including a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a global network (the Internet), etc. Accordingly, thenetwork 132 may include one or more communicatively coupled network computing devices (not shown) for facilitating the flow and/or processing of network communication traffic via a series of wired and/or wireless interconnects. Such network computing devices may include, but are not limited, to one or more access points, routers, switches, servers, compute devices, storage devices, etc. - For example, one or more of such network computing devices may be configured to couple the
endpoint computing device 144 to thenetwork 132 in a LAN configuration using wired (e.g., Ethernet, token ring, etc.) and/or wireless (e.g., Bluetooth®, Wi-Fi®, wireless broadband, ZigBee®, etc.) communication technologies and associated protocols. In furtherance of the example, the LAN may be coupled (e.g., via coaxial, mobile telephony, fiber, etc.) to one or more larger area networks (e.g., WANs, metropolitan area networks (MANs), the Internet, etc.) via additional network computing devices of thenetwork 132. - Each of the cloud
service provider interface 120 and the cloudservice broker interface 126 may be embodied as any combination of software, hardware, firmware, and circuitry capable of performing the functions described herein. In some embodiments, one or both of the cloudservice provider interface 120 and the cloudservice broker interface 126 may be configured to render information (e.g., via a user interface (UI)) to a display of the serviceprovider computing device 118 and thebroker computing device 114, respectively. In such embodiments, the one or both of the cloudservice provider interface 120 and the cloudservice broker interface 126 may be configured to relay inputs received from a user to login, configure the respective interface, or manipulate information (e.g., settings) associated therewith. - Referring now to
FIG. 4 , anillustrative method 400 is provided for adding a new cloud service to a cloud service broker marketplace (e.g., the cloudservice broker marketplace 104 ofFIG. 1 ) that may be performed by a marketplace computing device (e.g., themarketplace computing device 102 ofFIG. 1 ), or more particularly by a connector hub (e.g., theconnector hub 106 ofFIG. 1 ) of themarketplace computing device 102. To do so, inblock 402, theconnector hub 106 determines whether a new cloud service is to be added to the available cloud services of the cloudservice broker marketplace 104. Such a determination may be based on whether an indication was received by the connector hub 106 (e.g., from the cloud service provider interface 120) that indicates to add the new cloud service to the cloudservice broker marketplace 104. - If
connector hub 106 determines that a new cloud service is to be added, themethod 400 advances to block 404. Inblock 404, theconnector hub 106 retrieves an address (e.g., a uniform resource identifier (URI)) associated with the cloud service accessible via a cloud service provider interface (e.g., the cloudservice provider interface 120 ofFIG. 1 ) of the serviceprovider computing device 118. Inblock 406, theconnector hub 106 generates provisioning channel credentials (i.e., provider provisioning channel credentials) for the cloud service provider. It should be appreciated that, in some embodiments, the provider provisioning channel credentials may be received from a cloud service provider (e.g., generated by and received via the cloud service provider interface 120). Inblock 408, theconnector hub 106 stores the retrieved cloud service provider address and the provider provisioning channel credentials generated inblock 406 to a secure database local to the connector hub 106 (e.g., thecredentials database 108 ofFIG. 1 ), such as may be secured using technologies known in the art (e.g., a hardware security module). Inblock 410, theconnector hub 106 transmits the provider provisioning channel credentials to the cloudservice provider interface 120. - In
block 412, theconnector hub 106 determines whether an API connector has been received from the cloud service provider (e.g., via the cloud service provider interface 120). As described previously, the API connector may be comprised of source code usable to replicate an instance of the API connector. It should be appreciated that addition information related to the API connector may be received with the API connector inblock 412. Such additional information may include an identifier of the API connector. If the API connector has been received, themethod 400 advances to block 414, in which theconnector hub 106 stores the API connector received inblock 412 into a secure database local to the connector hub 106 (e.g., theavailable services database 110 ofFIG. 1 ), such as may be secured using technologies known in the art (e.g., a hardware security module). Additionally, inblock 416, theconnector hub 106 stores the source code of the API connector in theavailable services database 110. Further, inblock 418, the connector hub stores an identifier of the cloud service associated with the API connector received inblock 412 in theavailable services database 110. - Referring now to
FIGS. 5 and 6 ,illustrative methods provisioning channel 140 ofFIG. 1 ) between a cloud service provider interface (e.g., the cloudservice provider interface 120 ofFIG. 1 ) and a cloud service broker interface (e.g., the cloudservice broker interface 126 ofFIG. 1 ) that may be performed by themarketplace computing device 102, or more particularly by a connector hub (e.g., theconnector hub 106 ofFIG. 1 ) of themarketplace computing device 102. As described previously, an authentication proxy instance (e.g., theauthentication proxy instance 114 ofFIG. 1 ) may be deployed in establishing the provisioning channel. InFIG. 5 , theillustrative method 500 describes an embodiment in which theauthentication proxy instance 114 is deployed in theprovisioning channel 140. InFIG. 6 , theillustrative method 600 describes an embodiment in which theauthentication proxy instance 114 is not deployed in theprovisioning channel 140. - As shown in
FIG. 5 , themethod 500 begins inblock 502, in which theconnector hub 106 determines whether an API connector provision notification has been received. In some embodiments, the API connector provision notification may be received from the cloudservice broker marketplace 104, which was generated in response to a cloud service broker having requested that an available cloud service be added to their cloud service portfolio. If theconnector hub 106 determines that an API connector provision notification has been received, themethod 500 advances to block 504. - In
block 504, theconnector hub 106 generates broker provisioning channel credentials for a cloud service broker associated with the API connector provision notification received in block 502 (e.g., based on an identifier of that cloud service broker received with the API connector provision notification in block 502). It should be appreciated that theconnector hub 106 may be configured to store the generated broker provisioning channel credentials in a credentials database local to the connector hub 106 (e.g., thecredentials database 108 ofFIG. 1 ). Inblock 506, theconnector hub 106 transmits the broker provisioning channel credentials to a cloud service broker based on an address of the cloud service broker received with the API connector provision notification. It should be appreciated that theconnector hub 106 may be configured to store the cloud service broker address in a database, such as thecredentials database 108. Inblock 508, theconnector hub 106 generates proxy channel provisioning channel credentials. - In
block 510, theconnector hub 106 deploys an API connector instance (e.g., theAPI connector instance 116 ofFIG. 1 ) based on source code of the API connector retrieved from an available services database (e.g., theavailable service database 110 ofFIG. 1 ) using an identifier of the API connector that was received with the API connector provision notification inblock 502 to perform the API connector lookup on theavailable service database 110. - In
block 512, theconnector hub 106 transmits provider provisioning channel information to theAPI connector instance 116 that is usable to establish the communication channel (e.g., thecommunication channel 134 ofFIG. 1 ) between the cloudservice provider interface 120 and theAPI connector instance 116. Accordingly, such provider provisioning channel information includes the provider provisioning channel credentials associated with the cloud service provider to which an identifier of the cloud service corresponds and the address of the cloud service provider. Additionally, inblock 512, theconnector hub 106 further transmits proxy provisioning channel information to theAPI connector instance 116 that is usable to establish the communication channel (e.g., thecommunication channel 136 ofFIG. 1 ) between theAPI connector instance 116 and an authentication proxy instance. Accordingly, such proxy channel provisioning information includes the proxy channel provisioning channel credentials. - In
block 514, theconnector hub 106 deploys an authentication proxy instance (e.g., theauthentication proxy instance 114 ofFIG. 1 ). Additionally, inblock 516, theconnector hub 106 transmits broker provisioning channel information to theauthentication proxy instance 114 that is usable to establish the communication channel between theauthentication proxy instance 114 and the cloud service broker interface 126 (e.g., thecommunication channel 138 ofFIG. 1 ). Such broker provisioning channel information includes the broker provisioning channel credentials associated with the cloud service broker to which the cloud service broker identifier corresponds and the address of the cloud service broker. Theconnector hub 106, inblock 516, further transmits proxy provisioning channel credentials to theauthentication proxy instance 114 that are usable to establish the communication channel between theAPI connector instance 116 and the authentication proxy instance 114 (e.g., thecommunication channel 136 ofFIG. 1 ). - In
block 518, theconnector hub 106 establishes a portion of theprovisioning channel 140 between the cloudservice provider interface 120 and theauthentication proxy instance 114. To do so, inblock 520, theconnector hub 106 establishes thecommunication channel 134 between theAPI connector instance 116 and the cloudservice provider interface 120 using the provider provisioning channel credentials. Additionally, inblock 522, theconnector hub 106 establishes thecommunication channel 136 between theAPI connector instance 116 and theauthentication proxy instance 114 using the proxy provisioning channel credentials (i.e., to verify to each other entity that they are who they claim to be) using any authentication operation(s) known to those of skill in the art. - It should be appreciated that subsequent to establishing the portion of the
provisioning channel 140 described inFIG. 5 , the remaining portion of the provisioning channel 140 (i.e., thecommunication channel 138 between the cloudservice broker interface 126 and the authentication proxy instance 114) remains to be established. To establish thecommunication channel 138, inblock 524, theconnector hub 106 transmits a message that includes an address (e.g., a URI) of theAPI connector instance 116, which is usable to establish a communication channel (e.g., the communication channel 138) between theauthentication proxy instance 114 and the cloudservice broker interface 126. In some embodiments, the message indicating theauthentication proxy instance 114 has been deployed may be placed in a message queue from which the notifications are either pushed by theconnector hub 106 or pulled by the cloudservice broker interface 126. - In some embodiments, a monitoring agent (e.g., the
monitoring agent 128 ofFIG. 1 ) may have been previously deployed on a cloud service broker (e.g., the cloud service broker interface 126) that is usable to receive/retrieve the indication. In such embodiments, upon detection of the indication, themonitoring agent 128 may initiate the establishment of thecommunication channel 138 between the cloudservice broker interface 126 and theauthentication proxy instance 114 using the broker provisioning channel credentials (see, e.g., themethod 700 ofFIG. 7 ). Accordingly, the indication includes an address (e.g., in a URI) of theauthentication proxy instance 114 deployed inblock 608 that usable by themonitoring agent 128 to establish thecommunication channel 138 and complete theprovisioning channel 140. It should be appreciated that, in alternative embodiments that do not include themonitoring agent 128, the configuration of thecommunication channel 138 may be performed manually at the cloudservice broker interface 126. - In an illustrative example, as shown in
FIG. 2 , acommunication channel 134 is established between the cloud service provider interface (1) 210 and the cloud service broker interface (1) 202. To do so, in use, the API connector (1) 226 establishes thecommunication channel 134 with the cloud service provider interface (1) 210, via the API (1) 212, by performing an authentication operation using the provider provisioning channel credentials previously transmitted to the API connector (1) 226 and the cloud service provider interface (1) 210. Similarly, anothercommunication channel 134 is established between the cloud service provider interface (2) 214 and the cloud service broker interface (1) 202. To do so, in use, the API connector (1) 228 establishes thecommunication channel 134 with the cloud service provider interface (2) 214, via the API (2) 216, by performing an authentication operation using the provider provisioning channel credentials previously provided to the API connector (1) 228 and the cloud service provider interface (2) 214. - In furtherance of the illustrative example, a
communication channel 136 is established between the API connector (1) 226 and the authentication proxy (1) 218 by performing an authentication operation using the proxy provisioning channel credentials associated with the API connector (1) 226 and the authentication proxy (1) 218. Similarly, anothercommunication channel 136 is established between the API connector (2) 228 and the authentication proxy (2) 220 by performing an authentication operation using the proxy provisioning channel credentials associated with the API connector (2) 228 and the authentication proxy (2) 220. - Additionally, in furtherance of the illustrative example, a
communication channel 138 is established between the cloud service broker interface (1) 202 and the authentication proxy (1) 218. To do so, in use, the cloud service broker interface (1) 202 and the authentication proxy (1) 218 perform an authentication operation using the broker provisioning channel credentials previously provided to the cloud service broker interface (1) 202 and the authentication proxy (1) 218. Similarly, anothercommunication channel 138 is established between the cloud service broker interface (1) 202 and the authentication proxy (2) 220. To do so, in use, the cloud service broker interface (1) 202 and the authentication proxy (2) 220 perform an authentication operation using the broker provisioning channel credentials previously provided to the cloud service broker interface (1) 202 and the authentication proxy (2) 220. - It should be appreciated, as described previously, that an
authentication proxy instance 114 may not be deployed in some embodiments. In such embodiments, thecommunication channel 138 extends from the respective cloudservice broker interface 126 directly to the respectiveAPI connector instance 116. Irrespective of whether theauthentication proxy instance 114 is deployed in the provisioning channel or not, unlike present technologies, neither the cloud service provider interfaces 120 nor the cloud service broker interfaces 126 have access to the other's provisioning channel credentials, thereby providing a secure extension of therespective APIs 122 of cloud service providers. - As shown in
FIG. 6 , themethod 600 begins inblock 602, in which theconnector hub 106 determines whether an API connector provision notification has been received. In some embodiments, the API connector provision notification may be received from the cloudservice broker marketplace 104, which was generated in response to a cloud service broker having requested that an available cloud service be added to their cloud service portfolio. If theconnector hub 106 determines that an API connector provision notification has been received, themethod 600 advances to block 604. - In
block 604, theconnector hub 106 generates broker provisioning channel credentials for a cloud service broker associated with the API connector provision notification received in block 602 (e.g., based on an identifier of that cloud service broker received with the API connector provision notification in block 602). It should be appreciated that theconnector hub 106 may be configured to store the generated broker provisioning channel credentials in a credentials database local to the connector hub 106 (e.g., in thecredentials database 108 ofFIG. 1 ). It should be further appreciated that, in some embodiments, the broker provisioning channel credentials may be received from a cloud service broker (e.g., generated by and received via the cloud service broker interface 126). Inblock 606, theconnector hub 106 transmits the broker provisioning channel credentials to a cloud service broker based on an address of the cloud service broker received with the API connector provision notification. It should be appreciated that theconnector hub 106 may be configured to store the cloud service broker address in a database, such as thecredentials database 108. - In
block 608, theconnector hub 106 deploys an API connector instance (e.g., theAPI connector instance 116 ofFIG. 1 ) based on source code of the API connector retrieved from an available services database (e.g., theavailable service database 110 ofFIG. 1 ) using an identifier of the API connector that was received with the API connector provision notification inblock 602 to perform the API connector lookup on theavailable service database 110. Additionally, inblock 610, theconnector hub 106 transmits provider provisioning channel information to theAPI connector instance 116 that is usable to establish the communication channel (e.g., thecommunication channel 134 ofFIG. 1 ) between the cloudservice provider interface 120 and theAPI connector instance 116. Accordingly, such provider provisioning channel information includes the provider provisioning channel credentials associated with the cloud service provider to which an identifier of the cloud service corresponds and the address of the cloud service provider. - Further, in
block 612, theconnector hub 106 transmits broker provisioning channel information to theAPI connector instance 116 that is usable to establish a communication channel between theAPI connector instance 116 and the cloud service broker interface 126 (e.g., thecommunication channel 138 ofFIG. 1 ). Such broker provisioning channel information includes the broker provisioning channel credentials associated with the cloud service broker to which the cloud service broker identifier corresponds and the address of the cloud service broker. - In
block 614, theconnector hub 106 establishes a provisioning channel between the cloudservice provider interface 120 and the cloudservice broker interface 126. To do so, inblock 616, theconnector hub 106 establishes thecommunication channel 134 between theAPI connector instance 116 and the cloudservice provider interface 120 using the provider provisioning channel credentials. Additionally, inblock 618, theconnector hub 106 establishescommunication channel 138 between theAPI connector instance 116 and the cloudservice broker interface 126 using the broker provisioning channel credentials. Inblock 620, theconnector hub 106 transmits a message that includes an address (e.g., a URI) of theAPI connector instance 116, which is usable to establish a communication channel (e.g., the communication channel 138) between theAPI connector instance 116 and the cloudservice broker interface 126. In some embodiments, the message indicating theAPI connector instance 116 has been deployed may be placed in a message queue from which the notifications are either pushed by theconnector hub 106 or pulled by the cloudservice broker interface 126. - In some embodiments, a monitoring agent (e.g., the
monitoring agent 128 ofFIG. 1 ) may have been previously deployed on a cloud service broker (e.g., the cloud service broker interface 126) that is usable to receive/retrieve the indication. In such embodiments, upon detection of the indication, themonitoring agent 128 may initiate the establishment of thecommunication channel 138 between the cloudservice broker interface 126 and theAPI connector instance 116 using the broker provisioning channel credentials (see, e.g., themethod 700 ofFIG. 7 ). Accordingly, the indication includes an address of the API connector instance 116 (e.g., in a URI) deployed inblock 608 that usable by themonitoring agent 128 to establish thecommunication channel 138 and complete theprovisioning channel 140. It should be appreciated that, in alternative embodiments that do not include themonitoring agent 128, the configuration of thecommunication channel 138 may be performed manually at the cloudservice broker interface 126. - Referring now to
FIG. 7 , anillustrative method 700 is provided for configuring a cloud service for resale by a cloud service broker that may be performed by a cloud service broker interface of a broker computing device (e.g., the cloudservice broker interface 126 of thebroker computing device 124 ofFIG. 1 ), or more particularly by a monitoring agent (e.g., themonitoring agent 128 ofFIG. 1 ) of the cloudservice broker interface 126. Themethod 600 begins inblock 702, in which themonitoring agent 128 determines whether a new API connector instance (e.g., the API connector instance 116) has been detected. - Under certain conditions, source code of an API connector (i.e., used to deploy an API connector instance 116) may be changed by the cloud service provider. Under such conditions, the
connector hub 106 is configured to deploy new instances of the API connector. Accordingly, as a result of the trusted relationship between the new instance of theauthentication proxy instance 114 and the cloudservice broker interface 126, thecommunication channel 136 may be re-stablished without additional configuration. It should be appreciated that themonitoring channel 142 may be established between themonitoring agent 128 and theconnector hub 106 to transmit messages therebetween. Such messages include messages that indicate the health (e.g., quality of service) of thecommunication channel 136, as well as message which indicate that a newAPI connector instance 116 is available, thereby triggering themethod 700. - It should be further appreciated that, under certain conditions, a new
authentication proxy instance 114 may be deployed and/or the broker provisioning channel credentials changed. Under such conditions,connector hub 106 is configured notify the cloudservice broker interface 126 of the newauthentication proxy instance 114 and/or the new broker provisioning channel credentials. Accordingly, one of themethods authentication proxy instance 114, may be used to re-establish thecommunication channel 138. In some embodiments, such notification may be performed via a monitoring channel (see, e.g., themonitoring channel 142 ofFIG. 1 ) between themonitoring agent 128 and theconnector hub 106. - If the
monitoring agent 128 determines that a newAPI connector instance 116 has been detected, themethod 700 advances to block 704. Inblock 704, themonitoring agent 128 configures a communication channel (e.g., thecommunication channel 138 of the provisioning channel 140) with the newAPI connector instance 116 that was detected inblock 702. To do so, in some embodiments, inblock 706, themonitoring agent 128 configures thecommunication channel 138 based on a URI of an authentication proxy instance (e.g., theauthentication proxy instance 114 ofFIG. 1 ) that is associated with the newAPI connector instance 116. Otherwise, in alternative embodiments (i.e., embodiments in which theauthentication proxy instance 114 is not deployed), inblock 708, themonitoring agent 128 configures thecommunication channel 138 based on a URI that includes information usable to establish the communication channel with the newAPI connector instance 116. - In
block 710, themonitoring agent 128 configures the cloudservice broker interface 126 to allow resale of the cloud service associated with the newAPI connector instance 114. To do so, inblock 712, themonitoring agent 128 configures the cloudservice broker interface 126 based on default settings received from the connector hub 106 (e.g., via the monitoring channel 142). The default settings may include sales plans, service templates, pricing models, descriptions, etc. It should be appreciated that the settings may be changed by the cloud service broker (e.g., via the cloud service broker interface 126) upon completion of the initial configuration performed inblock 710. - It should be appreciated that, under certain conditions, the
monitoring agent 128 may have not been deployed prior to themethod 700 being performed. In such embodiments, the cloudservice broker marketplace 104 may be configured to provide an indication to the cloudservice interface broker 126 to deploy themonitoring agent 128. Such an indication may include information usable to initially configure themonitoring agent 128, as well as information usable by themonitoring agent 128 to monitor the health ofcommunication channel 138. Upon successful deployment and successful configuration of the cloud service for resale, themonitoring agent 128 may then monitor the health ofcommunication channel 138 and report to theconnector hub 106 results of the monitoring operation. - While the present disclosure has been illustrated and described in detail in the drawings and foregoing description, the same is to be considered as illustrative and not restrictive in character, it being understood that only certain embodiments have been shown and described, and that all changes and modifications that come within the spirit of the present disclosure are desired to be protected.
Claims (24)
Priority Applications (19)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/393,354 US20180191718A1 (en) | 2016-12-29 | 2016-12-29 | Technologies for securely extending cloud service apis in a cloud service marketplace |
MX2019007818A MX2019007818A (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace. |
LTEPPCT/US2017/068537T LT3563250T (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
CN201780087249.2A CN110313000B (en) | 2016-12-29 | 2017-12-27 | Method for securely extending cloud service API in cloud service marketplace |
EP17887864.1A EP3563250B1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
HUE17887864A HUE057502T2 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
SI201731042T SI3563250T1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
RS20220097A RS62921B1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
AU2017388219A AU2017388219B2 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service APIs in a cloud service marketplace |
HRP20220202TT HRP20220202T1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
PT178878641T PT3563250T (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
DK17887864.1T DK3563250T3 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely deploying cloud service APIs in a cloud service marketplace |
ES17887864T ES2905794T3 (en) | 2016-12-29 | 2017-12-27 | Technologies to safely extend cloud services APIs in a cloud services marketplace |
PL17887864.1T PL3563250T3 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
PCT/US2017/068537 WO2018125919A1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
CA3048423A CA3048423A1 (en) | 2016-12-29 | 2017-12-27 | Technologies for securely extending cloud service apis in a cloud service marketplace |
JP2019534950A JP6884214B2 (en) | 2016-12-29 | 2017-12-27 | Technology to securely extend cloud service APIs in the cloud service marketplace |
CY20221100097T CY1125012T1 (en) | 2016-12-29 | 2022-02-04 | TECHNOLOGIES FOR SECURELY EXTENDING ARI CLOUD SERVICES IN A CLOUD MARKETPLACE |
US17/659,419 US20220239649A1 (en) | 2016-12-29 | 2022-04-15 | Technologies for securely extending cloud service apis in a cloud service marketplace |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/393,354 US20180191718A1 (en) | 2016-12-29 | 2016-12-29 | Technologies for securely extending cloud service apis in a cloud service marketplace |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/659,419 Continuation US20220239649A1 (en) | 2016-12-29 | 2022-04-15 | Technologies for securely extending cloud service apis in a cloud service marketplace |
Publications (1)
Publication Number | Publication Date |
---|---|
US20180191718A1 true US20180191718A1 (en) | 2018-07-05 |
Family
ID=62710598
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/393,354 Abandoned US20180191718A1 (en) | 2016-12-29 | 2016-12-29 | Technologies for securely extending cloud service apis in a cloud service marketplace |
US17/659,419 Pending US20220239649A1 (en) | 2016-12-29 | 2022-04-15 | Technologies for securely extending cloud service apis in a cloud service marketplace |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/659,419 Pending US20220239649A1 (en) | 2016-12-29 | 2022-04-15 | Technologies for securely extending cloud service apis in a cloud service marketplace |
Country Status (18)
Country | Link |
---|---|
US (2) | US20180191718A1 (en) |
EP (1) | EP3563250B1 (en) |
JP (1) | JP6884214B2 (en) |
CN (1) | CN110313000B (en) |
AU (1) | AU2017388219B2 (en) |
CA (1) | CA3048423A1 (en) |
CY (1) | CY1125012T1 (en) |
DK (1) | DK3563250T3 (en) |
ES (1) | ES2905794T3 (en) |
HR (1) | HRP20220202T1 (en) |
HU (1) | HUE057502T2 (en) |
LT (1) | LT3563250T (en) |
MX (1) | MX2019007818A (en) |
PL (1) | PL3563250T3 (en) |
PT (1) | PT3563250T (en) |
RS (1) | RS62921B1 (en) |
SI (1) | SI3563250T1 (en) |
WO (1) | WO2018125919A1 (en) |
Cited By (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10425292B1 (en) * | 2018-10-17 | 2019-09-24 | Servicenow, Inc. | Functional discovery and mapping of serverless resources |
US20200073642A1 (en) * | 2018-08-30 | 2020-03-05 | Ingram Micro, Inc. | System and method of analysis and generation of navigation schema |
US10693968B2 (en) * | 2018-09-12 | 2020-06-23 | Pivotal Software, Inc. | Secure binding workflow |
US10911558B1 (en) * | 2019-05-15 | 2021-02-02 | Pivotal Software, Inc. | On-demand network segmentation |
US11036885B1 (en) * | 2018-01-06 | 2021-06-15 | Very Good Security, Inc. | System and method for identifying, storing, transmitting, and operating on data securely |
US11106441B2 (en) * | 2018-09-14 | 2021-08-31 | Microsoft Technology Licensing, Llc | Secure device-bound edge workload delivery |
CN114450928A (en) * | 2019-07-26 | 2022-05-06 | 路创技术有限责任公司 | Provisioning of multiple cloud-based services to a control device |
US11481234B2 (en) * | 2018-10-18 | 2022-10-25 | Sap Se | Serverless function as a service (FAAS) |
US20220413879A1 (en) * | 2021-06-28 | 2022-12-29 | Dropbox, Inc. | Co-managing links with a link platform and partner service |
US11675864B2 (en) | 2021-06-28 | 2023-06-13 | Dropbox, Inc. | Proxy links to support legacy links |
US11677617B1 (en) | 2022-04-24 | 2023-06-13 | Vmware, Inc. | Highly available and scalable SaltStack based management pane for application monitoring |
US11714729B1 (en) | 2021-12-21 | 2023-08-01 | Vmware, Inc. | Highly available and scalable telegraf based application monitoring |
US11729161B1 (en) * | 2022-12-15 | 2023-08-15 | Citibank, N.A. | Pre-built, pre-tested, and standardized connectors for end-to-end connection |
US20230269146A1 (en) * | 2022-02-24 | 2023-08-24 | Vmware, Inc. | Any application any agent |
AU2022304619B2 (en) * | 2021-06-28 | 2023-10-05 | Dropbox, Inc. | Co-managing links with a link platform and partner service |
US11811857B1 (en) * | 2022-10-28 | 2023-11-07 | Productiv, Inc. | SaaS application contract terms benchmarking in a SaaS management platform |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP7406018B1 (en) | 2023-01-26 | 2023-12-26 | エヌ・ティ・ティ・コミュニケーションズ株式会社 | Management device, management method and management program |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20120005262A1 (en) * | 2010-07-01 | 2012-01-05 | Mcwhirter Robert Kelley | Architecture, system and method for providing a neutral application programming interface for accessing different cloud computing systems |
US20140059226A1 (en) * | 2012-08-21 | 2014-02-27 | Rackspace Us, Inc. | Multi-Level Cloud Computing System |
US20140101434A1 (en) * | 2012-10-04 | 2014-04-10 | Msi Security, Ltd. | Cloud-based file distribution and management using real identity authentication |
US20150154418A1 (en) * | 2013-12-02 | 2015-06-04 | Fortinet, Inc. | Secure cloud storage distribution and aggregation |
US20170149784A1 (en) * | 2015-11-24 | 2017-05-25 | Cisco Technology, Inc. | Delegated access control of an enterprise network |
US20170208118A1 (en) * | 2016-01-20 | 2017-07-20 | Samsung Electronics Co., Ltd. | Electronic communication device |
US9716728B1 (en) * | 2013-05-07 | 2017-07-25 | Vormetric, Inc. | Instant data security in untrusted environments |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8965957B2 (en) * | 2010-12-15 | 2015-02-24 | Sap Se | Service delivery framework |
US9032494B2 (en) * | 2011-11-10 | 2015-05-12 | Sony Corporation | Network-based revocation, compliance and keying of copy protection systems |
US9430640B2 (en) * | 2012-09-28 | 2016-08-30 | Intel Corporation | Cloud-assisted method and service for application security verification |
US9467395B2 (en) * | 2013-03-13 | 2016-10-11 | Vmware, Inc. | Cloud computing nodes for aggregating cloud computing resources from multiple sources |
US9832205B2 (en) * | 2013-03-15 | 2017-11-28 | International Business Machines Corporation | Cross provider security management functionality within a cloud service brokerage platform |
US9356962B2 (en) * | 2013-09-10 | 2016-05-31 | Vmware, Inc. | Extensible multi-tenant cloud-management system and methods for extending functionalities and services provided by a multi-tenant cloud-managment system |
CN105900396B (en) * | 2014-02-07 | 2019-05-31 | 甲骨文国际公司 | Mobile cloud service architectural framework |
US9753669B2 (en) * | 2014-05-13 | 2017-09-05 | Velostrata Ltd. | Real time cloud bursting |
US9826100B2 (en) * | 2015-06-10 | 2017-11-21 | Flexera Software Llc | Usage tracking for software as a service (SaaS) applications |
US9606794B1 (en) * | 2015-12-16 | 2017-03-28 | International Business Machines Corporation | Generating and managing applications using any number of different platforms |
WO2018053072A1 (en) * | 2016-09-16 | 2018-03-22 | Pivotal Software, Inc. | Credential management in cloud-based application deployment |
-
2016
- 2016-12-29 US US15/393,354 patent/US20180191718A1/en not_active Abandoned
-
2017
- 2017-12-27 SI SI201731042T patent/SI3563250T1/en unknown
- 2017-12-27 CA CA3048423A patent/CA3048423A1/en active Pending
- 2017-12-27 CN CN201780087249.2A patent/CN110313000B/en active Active
- 2017-12-27 LT LTEPPCT/US2017/068537T patent/LT3563250T/en unknown
- 2017-12-27 ES ES17887864T patent/ES2905794T3/en active Active
- 2017-12-27 PL PL17887864.1T patent/PL3563250T3/en unknown
- 2017-12-27 RS RS20220097A patent/RS62921B1/en unknown
- 2017-12-27 DK DK17887864.1T patent/DK3563250T3/en active
- 2017-12-27 WO PCT/US2017/068537 patent/WO2018125919A1/en unknown
- 2017-12-27 HR HRP20220202TT patent/HRP20220202T1/en unknown
- 2017-12-27 HU HUE17887864A patent/HUE057502T2/en unknown
- 2017-12-27 AU AU2017388219A patent/AU2017388219B2/en active Active
- 2017-12-27 MX MX2019007818A patent/MX2019007818A/en unknown
- 2017-12-27 EP EP17887864.1A patent/EP3563250B1/en active Active
- 2017-12-27 JP JP2019534950A patent/JP6884214B2/en active Active
- 2017-12-27 PT PT178878641T patent/PT3563250T/en unknown
-
2022
- 2022-02-04 CY CY20221100097T patent/CY1125012T1/en unknown
- 2022-04-15 US US17/659,419 patent/US20220239649A1/en active Pending
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20120005262A1 (en) * | 2010-07-01 | 2012-01-05 | Mcwhirter Robert Kelley | Architecture, system and method for providing a neutral application programming interface for accessing different cloud computing systems |
US20140059226A1 (en) * | 2012-08-21 | 2014-02-27 | Rackspace Us, Inc. | Multi-Level Cloud Computing System |
US20140101434A1 (en) * | 2012-10-04 | 2014-04-10 | Msi Security, Ltd. | Cloud-based file distribution and management using real identity authentication |
US9716728B1 (en) * | 2013-05-07 | 2017-07-25 | Vormetric, Inc. | Instant data security in untrusted environments |
US20150154418A1 (en) * | 2013-12-02 | 2015-06-04 | Fortinet, Inc. | Secure cloud storage distribution and aggregation |
US20170149784A1 (en) * | 2015-11-24 | 2017-05-25 | Cisco Technology, Inc. | Delegated access control of an enterprise network |
US20170208118A1 (en) * | 2016-01-20 | 2017-07-20 | Samsung Electronics Co., Ltd. | Electronic communication device |
Cited By (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11036885B1 (en) * | 2018-01-06 | 2021-06-15 | Very Good Security, Inc. | System and method for identifying, storing, transmitting, and operating on data securely |
US20200073642A1 (en) * | 2018-08-30 | 2020-03-05 | Ingram Micro, Inc. | System and method of analysis and generation of navigation schema |
US11269600B2 (en) * | 2018-08-30 | 2022-03-08 | Cloudblue Llc | System and method of analysis and generation of navigation schema |
US10693968B2 (en) * | 2018-09-12 | 2020-06-23 | Pivotal Software, Inc. | Secure binding workflow |
US11573778B2 (en) | 2018-09-14 | 2023-02-07 | Microsoft Technology Licensing, Llc | Secure device-bound edge workload delivery |
US11106441B2 (en) * | 2018-09-14 | 2021-08-31 | Microsoft Technology Licensing, Llc | Secure device-bound edge workload delivery |
US11611489B2 (en) | 2018-10-17 | 2023-03-21 | Servicenow, Inc. | Functional discovery and mapping of serverless resources |
US10425292B1 (en) * | 2018-10-17 | 2019-09-24 | Servicenow, Inc. | Functional discovery and mapping of serverless resources |
US11481234B2 (en) * | 2018-10-18 | 2022-10-25 | Sap Se | Serverless function as a service (FAAS) |
US10911558B1 (en) * | 2019-05-15 | 2021-02-02 | Pivotal Software, Inc. | On-demand network segmentation |
CN114450928A (en) * | 2019-07-26 | 2022-05-06 | 路创技术有限责任公司 | Provisioning of multiple cloud-based services to a control device |
US11675864B2 (en) | 2021-06-28 | 2023-06-13 | Dropbox, Inc. | Proxy links to support legacy links |
US11609770B2 (en) * | 2021-06-28 | 2023-03-21 | Dropbox, Inc. | Co-managing links with a link platform and partner service |
US20220413879A1 (en) * | 2021-06-28 | 2022-12-29 | Dropbox, Inc. | Co-managing links with a link platform and partner service |
AU2022304619B2 (en) * | 2021-06-28 | 2023-10-05 | Dropbox, Inc. | Co-managing links with a link platform and partner service |
US11714729B1 (en) | 2021-12-21 | 2023-08-01 | Vmware, Inc. | Highly available and scalable telegraf based application monitoring |
US20230269146A1 (en) * | 2022-02-24 | 2023-08-24 | Vmware, Inc. | Any application any agent |
US11677617B1 (en) | 2022-04-24 | 2023-06-13 | Vmware, Inc. | Highly available and scalable SaltStack based management pane for application monitoring |
US11811857B1 (en) * | 2022-10-28 | 2023-11-07 | Productiv, Inc. | SaaS application contract terms benchmarking in a SaaS management platform |
US11811858B1 (en) * | 2022-10-28 | 2023-11-07 | Productiv, Inc. | SaaS application contract terms benchmarking in a SaaS management platform |
US11729161B1 (en) * | 2022-12-15 | 2023-08-15 | Citibank, N.A. | Pre-built, pre-tested, and standardized connectors for end-to-end connection |
Also Published As
Publication number | Publication date |
---|---|
JP6884214B2 (en) | 2021-06-09 |
WO2018125919A1 (en) | 2018-07-05 |
ES2905794T3 (en) | 2022-04-12 |
PL3563250T3 (en) | 2022-09-26 |
CN110313000A (en) | 2019-10-08 |
HUE057502T2 (en) | 2022-05-28 |
AU2017388219A1 (en) | 2019-07-11 |
EP3563250A1 (en) | 2019-11-06 |
MX2019007818A (en) | 2019-10-30 |
LT3563250T (en) | 2022-03-10 |
US20220239649A1 (en) | 2022-07-28 |
HRP20220202T1 (en) | 2022-04-29 |
EP3563250B1 (en) | 2021-11-17 |
RS62921B1 (en) | 2022-03-31 |
CY1125012T1 (en) | 2023-06-09 |
PT3563250T (en) | 2022-01-18 |
JP2020503616A (en) | 2020-01-30 |
SI3563250T1 (en) | 2022-05-31 |
CA3048423A1 (en) | 2018-07-05 |
DK3563250T3 (en) | 2022-01-17 |
EP3563250A4 (en) | 2020-07-29 |
AU2017388219B2 (en) | 2022-04-21 |
CN110313000B (en) | 2023-01-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20220239649A1 (en) | Technologies for securely extending cloud service apis in a cloud service marketplace | |
AU2017286888B2 (en) | Technologies for managing application configurations and associated credentials | |
CA3079948C (en) | System and method for integrating cloud applications into a cloud service broker platform using an automated, universal connector package | |
US11238448B1 (en) | Efficient network service provisioning | |
US20150350377A1 (en) | Providing on-demand services | |
US11748079B2 (en) | Technologies for creating and distributing integration connectors in a cloud service brokerage system | |
US10445153B2 (en) | Technologies for managing web notifications in client-server systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
AS | Assignment |
Owner name: INGRAM MICRO INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KUZKIN, MAXIM;GREBENSCHIKOV, VLADIMIR;KHAEROV, ALEXANDER;AND OTHERS;REEL/FRAME:050652/0097 Effective date: 20161229 |
|
STCV | Information on status: appeal procedure |
Free format text: NOTICE OF APPEAL FILED |
|
STCV | Information on status: appeal procedure |
Free format text: APPEAL BRIEF (OR SUPPLEMENTAL BRIEF) ENTERED AND FORWARDED TO EXAMINER |
|
STCV | Information on status: appeal procedure |
Free format text: ON APPEAL -- AWAITING DECISION BY THE BOARD OF APPEALS |
|
AS | Assignment |
Owner name: JPMORGAN CHASE BANK, N.A., ILLINOIS Free format text: TERM LOAN SECURITY AGREEMENT;ASSIGNORS:INGRAM MICRO INC.;ACTIFY LLC;SHIPWIRE, INC.;AND OTHERS;REEL/FRAME:056756/0806 Effective date: 20210702 Owner name: JPMORGAN CHASE BANK, N.A., ILLINOIS Free format text: ABL SECURITY AGREEMENT;ASSIGNORS:INGRAM MICRO INC.;ACTIFY LLC;SHIPWIRE, INC.;AND OTHERS;REEL/FRAME:056756/0820 Effective date: 20210702 Owner name: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., ILLINOIS Free format text: NOTES SECURITY AGREEMENT;ASSIGNORS:INGRAM MICRO INC.;ACTIFY LLC;SHIPWIRE, INC.;AND OTHERS;REEL/FRAME:056756/0834 Effective date: 20210702 |
|
AS | Assignment |
Owner name: CLOUDBLUE LLC, CALIFORNIA Free format text: NUNC PRO TUNC ASSIGNMENT;ASSIGNOR:INGRAM MICRO INC.;REEL/FRAME:058081/0507 Effective date: 20211029 |
|
STCV | Information on status: appeal procedure |
Free format text: BOARD OF APPEALS DECISION RENDERED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION |