WO2017077049A1

WO2017077049A1 - Method for accessing a service

Info

Publication number: WO2017077049A1
Application number: PCT/EP2016/076693
Authority: WO
Inventors: Christophe Guionneau
Original assignee: Evidian
Priority date: 2015-11-04
Filing date: 2016-11-04
Publication date: 2017-05-11
Also published as: FR3043294A1

Abstract

The invention relates to a method for a client to access a service using a terminal via a multi-client programming interface (API), said API being implemented by an application server, said method being characterised in that it comprises the following steps: the terminal sends an identification request (1001), comprising a client identifier, to a configuration server; configuration information (1006) is received in response to the identification request, said configuration information being determined from the client identifier; and the terminal sends a request to connect (1007) to the service according to the configuration information received by the terminal.

Description

METHOD OF ACCESSING A SERVICE

TECHNICAL FIELD OF THE INVENTION

The field of the invention is that of "SaaS" services (software as a service), a branch of "Cloud Computing". More particularly, the invention relates to a method of accessing a SaaS service by a client using a terminal via a multi-client programming interface (API), in particular in a shared environment. In addition, the invention relates to a method for configuring a client application used for accessing said SaaS service.

STATE OF THE PRIOR ART "Software as a service" (SaaS) is a branch of the "cloud computing" (Cloud Computing). Cloud computing is computing resources distributed over the internet and offered as services to a plurality of users. A SaaS service is the application part of Cloud Computing. For a user, it is to access remotely (via a web browser) to applications (software) hosted and operated by a service provider that charges a right of use (subscription to a subscription). With a SaaS service, the software (word processing, messaging, etc.) is provided in the form of a service and no longer in the form of an installed computer program.

SaaS services pool the applications offered to a plurality of customers. The separation between the customers is done through the concept of "tenant" is the identification of the customer who subscribes to a subscription to access the service whether paid or not. This is referred to as "multi-tenant" services to designate services that simultaneously provide a plurality of clients using the same interfaces to access these services. Such services allow a service provider, by sharing resources such as machines, processor, memory or storage space, to achieve economies of scale in terms of costs. operation and maintenance. SaaS services increase their hardware capabilities based on customer demand and consumption.

Access to a SaaS cloud service is provided via a programming interface (API) that defines a common language between the client application accessed via a terminal and the service desired by the client. The API is usually based on the HTTP protocol and uses Uniform Resource Locators (URLs) to define an identifier of the application server to reach and the various functions exposed by ΓΑΡΙ. By "application server" is meant the server that hosts one or more application (s) to / to which a customer wishes to access. In Representational State Transfer (REST) type APIs, the headers

HTTP is used to transmit to the SaaS service holding it in the form of an API key (authentication key) or any other encrypted or secret data associated with the service holder. Indeed, it is recalled that the tenant allows to separate the customers of the service between them. In addition, each URL can be accessed using existing HHTP protocol verbs. Thus, operations such as create, display, update and delete will be performed using respectively the POST, GET, PUT, DELETE verbs of the HHTP protocol.

Once the client has issued a request / call to an API, the SaaS service provider uses the hold (obtained in the API calls or infers information from the API requests) to route the call to its infrastructure to dedicated application servers or to shared application servers according to the client's request which includes the identifiers of the tenant.

FIG. 1 represents a first IFR1 infrastructure according to the prior art of a relationship between a client (not shown) using a terminal (1, 2) and an application server 6.

It is noted that in the rest of the application, the term "customer" refers to a "tenant" that is to say a customer who subscribes for access to a service.

With reference to FIG. 1, a client (not shown) uses a terminal, for example a computer 1, a mobile phone 2, a tablet or an object connected to implement a client application. The client application is a web application or a native client application.

To access a service, a client passes, by means of the client application executed on its terminal (1, 2), by an API 4 exposed by the service provider by using the HTTP / HTTPs protocol and URLs.

The connection to the service via ΑΡΙ is performed after a step of authenticating the client with said API. Once the client is authenticated, a router 5 directs the network flows to the different application servers 6 so as to correctly provide the desired service to the client. Many documents describe systems allowing access, depending on the client (subscriber), shared services using an API. In particular, patent applications US2014282968 (A1) and US2013325986 (A1) describe systems for routing messages to APIs in the network of a service provider. In these requests, the routing of messages to the APIs is performed by means of a reverse proxy after identification of the client based on authentication or key mechanisms per client. In addition, the patent application US2013254266 (A1) describes a system for routing calls to an API to requested services. In this request, the routing of the requests sent to ΑΡΙ to an application server is performed by means of a reverse proxy after the identification of the client by mapping the IP address of said client. The client is then routed to the application server closest to said IP address.

In these systems, the URL of ΑΡΙ 4 is unique for all the clients, it contains an identifier of the application server 6, for example the DNS name or the IP address of the application server 6 providing the service as well as the path to the various functions proposed by ΑΡΙ 4. The URL address of ΑΡΙ is therefore a mandatory point of passage for all communication flows for the entire service. All queries issued by customers to ΑΡΙ are re-wired by service providers within their network and technical infrastructures. Routing, high availability, and load sharing mechanisms are used on the unique IP address of ΓΑΡΙ. The requests to ΑΡΙ then lead to application servers 6 capable of processing said requests. The service provider may have multiple 8 server hosting centers applications 6: several data centers 8 physically isolated to ensure mechanisms of "Disaster Recovery", that is to say activity recovery. These data centers 8 are geographically distributed over potentially several continents and are interconnected by specialized, secure and high-speed links.

However, the problem with such services using geographically remote data centers is that they do not ensure that a client is always routed to the same application server. More specifically, such services do not make it possible to assure the client that his requests are routed to an application server hosted in a geographical area whose data hosting laws and their protections are compatible with the legislations to which they are subject. the customer. For example, a customer of a global SaaS service can not be assured that his data will be hosted on European soil. A globalized society may have different hosting requirements and constraints depending on the country in which the company operates. Thus, the services according to the prior art do not allow a global society to choose, for each of the countries in which it is established, the geographical area (and therefore the legislation applied) in which its data are hosted. In addition, when the service is shared on a plurality of application servers, it is technically difficult to dedicate an application server to a specific client, when said client requests it, or when the use he makes The service requires more resources than shared clients on the same server.

To overcome the aforementioned problems due to the unique naming of ΓΑΡΙ, mechanisms can be implemented locally, for example by resolving the DNS names into different IP addresses by manipulating the configurations of the DNS servers (Domain Name System). However, this solution can be risky in terms of security and routing of IP addresses. For example, this solution would not be applicable for a customer who would use an API from multiple geographic regions using multiple internet connection providers. DNS resolutions may be inconsistent. In addition, service providers could provide differentiated access points to their APIs based on their customers. However, using this technique makes it difficult to set up a client application based on the characteristics of the client account. Indeed, the switching from a shared mode of the application server to a non-shared mode requires a manual reconfiguration of the client applications, synchronized with the configuration change of the service provider. In addition, in a secure mode (HTTPS), the provision of differentiated access points to the APIs according to the clients requires the generation of a plurality of security certificates validated by known certification authorities.

GENERAL DESCRIPTION OF THE INVENTION

In this context, the invention aims to remedy all or part of the disadvantages of the state of the art identified above, in particular by proposing a solution to ensure that requests from the same customer of a service will be routed to the application server (s) adapted to the client. In addition, the solution according to the invention does not require manual reconfiguration of the client for access to (x) said (s) application server (s) adapted (s).

Thus, according to a first aspect, the invention relates to a method for accessing a service by a client using a terminal via a multi-client programming interface (API), said API being implemented by an application server, said method comprising the following steps:

a transmission, by the terminal, of an identification request comprising an identifier of the client to a configuration server,

a reception of configuration information in response to the identification request, said configuration information being determined from the identifier of the client,

a transmission of a connection request to the service according to the configuration information received by the terminal. By "client" is meant a user of a SaaS service who has subscribed a subscription (paid or free) to said service.

In addition, the term "application server" means a server comprising the application (s) (software) used to execute queries issued by the clients via ΑΡΙ in order to access a service. The applications of the application server are stored in storage means of said application server. Furthermore, "configuration server" means a server comprising the application (s) (software) used to execute the requests issued by the clients to receive the configuration information. Configuration server applications are stored in storage means of said configuration server.

The step of issuing a request to the configuration server for receiving configuration information according to the client identification makes it possible to distribute the clients to applications adapted to said client. By adapted application is meant an application of a hosted application server, if necessary, in a geographical area whose data hosting laws and their protections are compatible with the legislation to which the customer is subject. Indeed, according to the data associated with the client contained in the configuration server, the client is automatically redirected to the application (s) of a shared application server or not that meets its requirements and / or constraints of accommodation. In addition, an automatic configuration of the configuration server makes it possible to automatically update the data associated with the client that is stored in said configuration server and thus ensure that the distribution of the clients to the application servers is always performed according to correct configuration information to access the desired service.

In addition to the main features which have just been mentioned in the preceding paragraph, the method according to the first aspect of the invention may have one or more of the following features, considered individually or according to the technically possible combinations:

the access method comprises a step of sending, by the terminal, an authentication request to the application server for access to the service;

the configuration information includes an identifier of the application server;

the configuration information includes a description of the implementation of the service by an absolute or relative URL list;

- the configuration information includes a security certificate;

- the configuration information is in JSON or XML format etc. ; the method comprises a step of configuring a configuration database containing the configuration information associated with the client;

the method includes a step of configuring a configuration zone, said configuration being according to the configuration information contained in the configuration database;

the terminal interacts with the API via a web application or a native client application.

In addition, according to a second aspect, the invention relates to a method for configuring a client application implemented by a terminal, a configuration server implementing the following steps:

a reception of an identification request from the terminal, said identification request comprising a customer identification information,

a transmission of a request for extracting configuration information according to the identification of the client, said configuration information comprising an identifier of an application server,

a reception of the configuration information associated with the client, said configuration information having been extracted from a configuration database associated with the identification of the client,

- issuing the configuration information to the client.

Furthermore, according to a third aspect, the invention relates to a computer readable recording medium on which is recorded a computer program comprising program code instructions for executing the steps of the method according to the first aspect. . In addition, according to a fourth aspect, the invention relates to a computer readable recording medium on which is recorded a computer program comprising program code instructions for executing the steps of the method according to the second aspect. .

BRIEF DESCRIPTION OF THE FIGURES Other characteristics and advantages of the invention will emerge on reading the description which follows, with reference to the appended figures, which illustrate: in FIG. 1, already described, a first infrastructure enabling the implementation of a method of access to a service according to the prior art,

in FIG. 2, a second infrastructure according to an embodiment allowing the implementation of the invention,

in FIG. 3, a server device,

in FIG. 4, the steps of the method of access to a service according to one embodiment of the invention, said access method being implemented by the second infrastructure presented in FIG.

The invention and its various applications will be better understood by reading the following description and examining the figures that accompany it.

DETAILED DESCRIPTION OF AT LEAST ONE EMBODIMENT OF THE INVENTION

Unless otherwise specified, the same element appearing in different figures has a unique reference.

The invention relates to a method for accessing a service by a client using a terminal (1, 2) via a multi-client programming interface (API) 4. In the following description, the desired service is a software service offered by a SaaS Cloud service. "Software Service" means word processing software, messaging, business applications, archiving applications, etc. searchable and usable online. A Saas Cloud service pools the functions proposed for several customers who can simultaneously use the service.

Figure 2 shows a second IFR2 infrastructure according to a first embodiment. The second IFR2 infrastructure makes it possible to implement a method of accessing a service via a multi-client API.

With reference to FIG. 2, the second IFR2 infrastructure implementing steps of the method according to the invention comprises:

a terminal (1, 2),

a configuration server 9,

an application server 6. The terminal (1, 2) is a computer 1, a mobile phone 2, a tablet or a connected object (not shown). The terminal (1, 2) allows a client to access a client application via a web application (lightweight) or a native client application (heavy). The client application executed by a client via its terminal (1, 2) communicates with the configuration server 9 and with the application server 6 to access a service. According to an embodiment, the configuration server 9 and the application server 6 form one and the same server.

The application server 6 and the configuration server 9 have a structure identical to that of the server device 100 shown in FIG.

As shown in FIG. 3, the server device 100 comprises:

a microprocessor 1 10,

storage means 120, for example a hard disk, whether local or remote, whether simple or in a grid (for example RAID);

a communication interface 130, for example a communication card according to the Ethernet protocol. Other protocols are possible as IP, Fiber Channel or InfiniBand.

The microprocessor 1 10 of the server device 100, the storage means 120 of the server device 100 and the communication interface 130 of the server device 100 are interconnected by a bus 150.

Remember that when an action is taken to a device it is actually performed by a microprocessor of the device controlled by instruction codes stored in a device memory. If an action is taken to an application, it is actually performed by a microprocessor of the device in a memory of which the instruction codes corresponding to the application are recorded. When a device, or an application sends a message, this message is sent via a communication interface of said device or of said application. In addition, it is noted that a device is real or virtual.

Furthermore, with reference to FIG. 3, the storage means 120 of the server device 100 comprise zones, in particular a database area120.1 in Figure 3. When the server device 100 is the configuration server 9, the database area 120.1 corresponds to a configuration base 7. The configuration base 7 includes structured data that associates information with an identifier.

In addition, with reference to FIG. 2, the terminal (1, 2), whether it is a computer 1, a mobile telephone 2, a tablet or a connected object, comprises:

a microprocessor 210,

storage means 220,

a communication interface 230, for example a wireless communication card,

a screen 240. The microprocessor 210 of the terminal (1, 2), the storage means 220 of the terminal (1, 2), the communication interface 230 of the terminal (1, 2) and the screen 240 of the terminal ( 1, 2) are interconnected by a bus 250.

In addition, FIG. 3 shows that the storage means 220 of the terminal (1, 2) comprise a configuration zone denoted 220.1 in FIG. 2. The configuration zone 220.1 includes data extracted from the database zone 120.1 or configuration database 7 of the configuration server 9, said data corresponding to information associated with the client using the terminal (1, 2). In addition, it is noted that the storage means 220 of the terminal (1, 2) also include a storage area 220.2 for storing instruction codes for the implementation of the invention.

FIG. 4 represents steps of the method of access to a service by a client using a terminal (1, 2) via a multi-client programming interface (API) 4. The steps of the method are implemented by the second IFR2 infrastructure presented above. Note that the naming of the steps set out in the following description is not limiting, the steps can be performed in a different order than that presented below. According to a preliminary step 1000, the configuration base 7 of the configuration server 9 is configured by the service provider. The configuration of the configuration base 7 makes it possible to store data associated with the client called configuration information or to update said data. According to a first step 1001, the client sends, via the terminal (1, 2), an identification request comprising an identifier of the client to the configuration server 9.

According to a second step 1002, the configuration server 9 receives the identification request sent by the client according to the first step 1001. According to one embodiment, the identification of the client with the configuration server 9 is performed by means of at least one data extracted from the identification request sent by the client. According to one embodiment, said at least one data item extracted from the identification request is data specific to the client dependent on the subscription of said client. The customer-specific data is, for example, an API key representing his subscription or a numerical identifier, alphanumeric or other, customer obtained when subscribing the customer to a subscription. According to another embodiment, the at least one data item extracted from the identification request is the Internet Protocol (IP) address associated with the terminal (1, 2) of said client. According to another embodiment, the identification of the client is carried out by means of a combination of the client-specific data and the IP address associated with the terminal (1, 2) of said client, and more generally by means of a combination of data extracted from the query.

In a third step 1003, inside the configuration server 9, a request for extracting configuration information is sent to the configuration base 7 of said configuration server 9. It is recalled that the configuration of the configuration database 7 is performed according to the preliminary step 1000. The determination of the configuration information to be extracted is performed using the client identifier issued during the first step 1001 by the client. In a fourth step 1004, the configuration server 9 receives the configuration information associated with the client identifier. According to a fifth step 1005, the configuration server 9 transmits the configuration information to the client.

According to a sixth step 1006, the client receives, at its terminal (1, 2), the configuration information sent by the configuration server 9 in response to the identification request sent by the client during the first step 1001.

The configuration information transmitted to the client makes it possible, if necessary, to direct the client to one or more software services contained in one or more application servers 6 hosted in a geographical area whose legislation on the accommodation is compatible with the legislation to which the customer is subject.

The configuration information received by the client is in the form of data in JSON, XML format, or any text format easily interpretable by the client application.

The configuration information received by the client contains an identifier of the application server 6. According to a first embodiment, the identifier of the application server 6 is the DNS name of the application server 6 to be obtained obtained by a system DNS (name resolution system). The URLs of the application server 6 to be reached are then deduced by the client application based on the DNS name of said application server 6. In addition, according to one embodiment, the configuration information includes a security certificate. of the application server 6. In addition, according to one embodiment, the security certificate is accompanied by the certification authority if the said authority is not known or is private to the SaaS service provider. According to a second embodiment, the configuration information includes a description of the implementation of the desired service by an absolute or relative URL list. "Absolute URL" is a URL that starts with the "http: //" protocol. "Relative URL" means a URL that does not start with the "http: //" protocol. The relative URL can be combined with the absolute URL of a "base" page to get the absolute URL of the resource to be named. The URLs in the URL list expose the functions of ΓΑΡΙ. According to one embodiment, the functions of the API are distributed over several application servers 6 and therefore several IP addresses. According to a third embodiment, the configuration information comprises a combination of the first embodiment (DNS name of the machine) and the second embodiment (list of URLs).

According to a seventh step 1007, the client sends, via its terminal (1, 2), a connection request to the service according to the configuration information received by the terminal (1, 2).

According to an eighth step 1008, the client sends, via its terminal (1, 2), an authentication request to a programming interface (API) so that the SaaS service provider ensures that the client has subscribed to a subscription to access the desired service. The connection to the service is via said API which allows the client application to establish network connections directly to the application server software service 6 associated with the client. For the authentication request, the identification data are the same as those used for the identification request of the second step 1002. According to another embodiment, the authentication is also performed during the second step 1002, the client then obtaining a session identifier that he uses during his communications with the application server 6.

According to a ninth step 1009, a configuration of a configuration zone 220.1 of the terminal (1, 2) is performed. In fact, the client application executed on the terminal (1, 2) periodically carries out the first step 1001 of sending an identification request to the configuration server 9, so that, according to the sixth step 1006, it receives information configuration associated with the client. When the client application of the terminal (1, 2) receives configuration information from the configuration server 9, said configuration information is stored in the configuration area 220.1 of the terminal (1, 2). The configuration area configuration 220.1 is periodically configured to detect changes (updates) in the configuration information. Thus, when a configuration area 220.1 stores the configuration information that is updated periodically from the information in the configuration database 7, when a customer wants to access a service, the client application directly uses the information configuration stored in the configuration area 220.1 of the terminal (1, 2). Thus, the client application no longer passes through the configuration server 9 but sends a request to the configuration area 220.1 of the terminal (1, 2) which directs it directly to the domain names of the application server 6 to reach and / or URLs with or without security certificates. Thus, thanks to the solution according to the invention, a client wishing to access a SaaS service is correctly routed to the application server or servers 6 which respect (s), if they exist, the requirements of said client. Even in case of demutualization or load balancing by the SaaS service provider depending on the availability / use of the application servers 6, the client is always routed to the service meeting its requirements.

Thus, thanks to the solution of the invention, the application servers 6 hosting one or more service (s) desired (s) by the customer are allocated according to the charges and shared hosting constraints or not and depending of the preferential geographical area in which the application server 6 is hosted.

Claims

Method of accessing a service by a client using a terminal (1, 2) via a multi-client programming interface (API) (4), said API (4) being implemented by an application server (6 ), said method being characterized in that it comprises the following steps:

- a transmission, by the terminal (1, 2), of an identification request (1001) comprising a client identifier to a configuration server (9),

- a reception of configuration information (1006) in response to the identification request, said configuration information being determined from the client identifier,

- a transmission by the terminal (1, 2), of a connection request (1007) to the service according to the configuration information received by the terminal (1, 2).

Access method according to claim 1 characterized in that it comprises a step of transmitting, by the terminal (1, 2), an authentication request (1008) to the application server (6) for access to the service.

Access method according to one of claims 1 to 2 characterized in that the configuration information includes an identifier of the application server

(6).

Access method according to one of claims 1 to 3 characterized in that the configuration information includes a description of the implementation of the service by a list of absolute or relative URLs.

Access method according to one of claims 1 to 4 characterized in that the configuration information includes a security certificate.

Access method according to any one of claims 1 to 5 characterized in that the configuration information is in JSON or XML etc. format.

7. Access method according to any one of claims 1 to 6 characterized in that it comprises a step of configuring (1000) a configuration base (7) containing the configuration information associated with the client.

8. Access method according to claim 7 characterized in that it comprises a step of configuring (1009) a configuration zone (220.1), said configuration being according to the configuration information contained in the configuration base (7). ).

9. Access method according to any one of claims 1 to 8 characterized in that the terminal (1, 2) interacts with the API (4) via a web application or a native client application.

10. Method for configuring a client application implemented by a terminal (1, 2), said method being characterized in that a configuration server (9) implements the following steps:

- a reception of an identification request (1002) from the terminal (1, 2), said identification request comprising client identification information, - a transmission of an extraction request (1003) of configuration information according to the identification of the client, said configuration information comprising an identifier of an application server (6),

- a reception of the configuration information (1004) associated with the client, said configuration information having been extracted from a configuration base (7) associated with the identification of the client,

- sending configuration information (1005) to the client.

1 1 . Computer-readable recording medium on which a computer program comprising program code instructions for carrying out the steps of the method according to one of Claims 1 to 9 is recorded.

12. Computer-readable recording medium on which is recorded a computer program comprising program code instructions for carrying out the method according to claim 10.