Extending a federated graph with third-party data and metadata

• US 10,050,953 B2
• Filed: 11/30/2015
• Issued: 08/14/2018
• Est. Priority Date: 11/30/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Mullins, Christopher Lee, Shewchuk, John Peter
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US14/954,539
• Publication Number:
  US 20170155658A1
• Time in Patent Office: 988 Days
• Field of Search: 726 9
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Technologies are described herein for extending a federated graph with third-party data or metadata. A federated facet provider service registers with a federated graph provider service as a provider of a facet for a resource in a graph. For example, the federated facet provider service can provide a callback uniform resource locator (“URL”) or a uniform resource identifier (“URI”) template for resolving the callback URL. When the federated graph provider service receives a request for a facet from a service client, the federated graph provider service determines a callback network address for the federated facet provider service and obtains an authentication token for the federated facet provider service. A response is provided to the service client that causes the service client to redirect to the federated facet provider service to obtain the requested facet utilizing the authentication token. The federated facet provider service provides the requested facet directly to the service client.

Claims

1. A computer-implemented method for integrating a first network service with a second network service, comprising:

sending a set of resource data from a resource in a computer-readable property graph to a service client via a first network service operating in a first network, with the graph being a collection of computer-readable content in a computer system, with the first network service being a federated graph provider service, and with the sending of the set of resource data being performed as part of a unified response to a single request submitted via a first network service application programming interface (API) provided by way of the first network service, with the unified response to the single request comprising data from multiple different federated computerized data providers, with the unified response comprising the set of resource data;

receiving a facet request from the service client for a facet of the resource in the graph via the first network service API, with the facet comprising additional data beyond the set of resource data sent to the service client via the first network service, with a registration of a second network service with the first network service to provide the facet occurring prior to the receiving of the facet request, and with the registration comprising the facet being associated with the resource in the graph through data or metadata associated with the first network service and a second network service;

identifying a network address of a second network service API exposed by the second network service;

obtaining, by way of the first network service, an authentication token for use in authenticating with the second network service; and

providing a response to the facet request received from the service client, the response comprising the authentication token and an instruction to the service client to perform a redirect to the network address of the second network service API exposed by the second network service to obtain the facet using the authentication token to authenticate with the second network service.

2. The computer-implemented method of claim 1, wherein the facet request comprises data identifying the resource and a unique identifier (ID) associated with the second network service.

3. The computer-implemented method of claim 2, wherein the second network service is operating in a second network different from the first network, and wherein identifying the network address of the second network service API exposed by the second network service comprises utilizing the unique ID associated with the second network service to retrieve a previously stored callback uniform resource locator (URL) for the second network service.

4. The computer-implemented method of claim 3, wherein the second network service registers with the first network service by providing the callback URL and the unique ID to the first network service.

5. The computer-implemented method of claim 2, wherein identifying the network address of the second network service API exposed by the second network service comprises:

utilizing the unique ID associated with the second network service to obtain a uniform resource identifier (URI) template for the second network service; and

resolving the URI template to generate the network address of the second network service API exposed by the second network service.

6. The computer-implemented method of claim 5, wherein the second network service registers with the first network service by providing the URI template and the unique ID to the first network service.

7. The computer-implemented method of claim 1, further comprising:

receiving, by way of the first network service, a request for information about the facet, the request for information about the facet comprising a unique identifier (ID) associated with the second network service;

utilizing the unique ID associated with the second network service to obtain the information about the facet; and

returning the information about the facet in response to the request for information.

8. The computer-implemented method of claim 1, further comprising:

receiving, by way of the first network service, a request for data identifying facets associated with the resource in the graph, the request for data comprising data identifying a location of the resource in the graph; and

returning the data identifying the facets associated with the resource in the graph in response to the request for data.

9. The computer-implemented method of claim 1, wherein the first network service is located in a first geographic location, wherein the second network service is located in a second geographic location, and wherein the service client is located in a third geographic location.

10. An apparatus, comprising:

one or more processors; and

at least one computer storage medium having computer executable instructions stored thereon which, when executed by the one or more processors, cause the apparatus to perform acts for integrating a first network service with a second network service, with the acts comprising;

sending a set of resource data from a resource in a computer-readable property graph to a service client via a first network service operating in a first network, with the graph being a collection of computer-readable content in a computer system, with the first network service being a federated graph provider service, and with the sending of the set of resource data being performed as part of a unified response to a single request submitted via a first network service application programming interface (API) provided by way of the first network service, with the unified response to the single request comprising data from multiple different federated computerized data providers, with the unified response comprising the set of resource data;

receiving a facet request from the service client for a facet of the resource in the graph via the first network service API, with the facet comprising additional data beyond the set of resource data sent to the service client via the first network service, with a registration of a second network service with the first network service to provide the facet occurring prior to the receiving of the facet request, and with the registration comprising the facet being associated with the resource in the graph through data or metadata associated with the first network service and a second network service;

identifying a network address of a second network service API exposed by the second network service,

obtaining, by way of the first network service, an authentication token for use in authenticating with the second network service, and

providing a response to the facet request received from the service client, the response comprising the authentication token and an instruction to the service client to perform a redirect to the network address of the second network service API exposed by the second network service to obtain the facet using the authentication token to authenticate with the second network service.

11. The apparatus of claim 10, wherein the facet request comprises data identifying a location in the graph of the resource and a unique identifier (ID) associated with the second network service, and wherein identifying the network address of the second network service API exposed by the second network service comprises utilizing the unique ID associated with the second network service to retrieve a previously stored callback uniform resource locator (URL) for the second network service.

12. The apparatus of claim 11, wherein the acts comprise the second network service registering with the first network service by providing the callback URL and the unique ID to the first network service.

13. The apparatus of claim 10, wherein the facet request comprises data identifying a location in the graph of the resource and a unique identifier (ID) associated with second network service, and wherein identifying the network address of the second network service API exposed by the second network service comprises:

utilizing the unique ID associated with the second network service to obtain a uniform resource identifier (URI) template for the second network service; and

resolving the URI template to generate the network address of the second network service API exposed by the second network service.

14. The apparatus of claim 13, wherein the acts comprise the second network service registering with the first network service by providing the URI template and the unique ID to the first network service.

15. The apparatus of claim 10, wherein the facet request is a first facet request and the first network service is further configured to:

transmit a second facet request to the second network service for the facet, the second facet request comprising the authentication token for the second network service;

receive the facet from the second network service; and

provide a reply to the second facet request for the facet to the service client comprising the facet and additional information for the resource in the graph obtained from one or more other network services operating within the first network.

16. A computer-readable storage medium having computer executable instructions stored thereon which, when executed by one or more processors, cause the processors to perform acts for integrating a first network service with a second network service, with the acts comprising:

sending a set of resource data from a resource in a computer-readable property graph to a service client via a first network service operating in a first network, with the graph being a collection of computer-readable content in a computer system, with the first network service being a federated graph provider service, and with the sending of the set of resource data being performed as part of a unified response to a single request submitted via a first network service application programming interface (API) provided by way of the first network service, with the unified response to the single request comprising data from multiple different federated computerized data providers, with the unified response comprising the set of resource data;

receiving a facet request from the service client for a facet of the resource in the graph via the first network service API, with the facet comprising additional data beyond the set of resource data sent to the service client via the first network service, with a registration of a second network service with the first network service to provide the facet occurring prior to the receiving of the facet request, and with the registration comprising the facet being associated with the resource in the graph through data or metadata associated with the first network service and a second network service;

identifying a network address of a second network service API exposed by the second network service;

obtaining, by way of the first network service, an authentication token for use in authenticating with the second network service; and

providing a response to the facet request received from the service client, the response comprising an authentication token and an instruction to the service client to perform a redirect to the network address of the second network service API exposed by the second network service to obtain the facet using the authentication token to authenticate with the second network service.

17. The computer-readable storage medium of claim 16, wherein the facet request comprises data identifying a location in the graph of the resource and a unique identifier (ID) associated with the second network service, and wherein identifying the network address of the second network service API exposed by the second network service comprises utilizing the unique ID associated with the second network service to retrieve a previously stored callback uniform resource locator (URL) for the second network service.

18. The computer-readable storage medium of claim 17, wherein the acts comprise the second network service registering with the first network service by providing the callback URL and the unique ID to the first network service.

19. The computer-readable storage medium of claim 16, wherein the facet request comprises data identifying a location in the graph of the resource and a unique identifier (ID) associated with second network service, and wherein identifying the network address of the second network service API exposed by the second network service comprises:

utilizing the unique ID associated with the second network service to obtain a uniform resource identifier (URI) template for the second network service; and

resolving the URI template to generate the network address of the second network service API exposed by the second network service.

20. The computer-readable storage medium of claim 19, wherein the acts comprise the second network service registering with the first network service by providing the URI template and the unique ID to the first network service.