TECHNOLOGIES FOR SECURELY EXTENDING CLOUD SERVICE APIS IN A CLOUD SERVICE MARKETPLACE

• US 20180191718A1
• Filed: 12/29/2016
• Published: 07/05/2018
• Est. Priority Date: 12/29/2016
• Status: Abandoned Application

• Current Assignee: Cloudblue LLC
• Original Assignee: Ingram Micro Incorporated (HNA Technology Co. Ltd.)
• Application Number:
  US15/393,354
• Publication Number:
  US 20180191718A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

Technologies for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace include a connector hub of a marketplace computing device communicatively coupled to a cloud service provider interface of a cloud service provider and a cloud service broker interface of a cloud service broker. The connector hub is configured to deploy an API connector instance in a connection factory of the marketplace computing device, transmit provider provisioning channel credentials to the API connector instance and the cloud service provider interface and transmit broker provisioning channel credentials to the API connector instance and the cloud service broker interface. The connector hub is additionally configured establish a provisioning channel between the cloud service provider interface and the cloud service broker interface. Additional embodiments are described herein.

Claims

1. A method for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, the method comprising:

deploying, by a connector hub of a marketplace computing device, an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;

transmitting, by the connector hub, provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmitting, by the connector hub, broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

establishing, by the connector hub, a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein establishing the provisioning channel comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

2. The method of claim 1, further comprising:

generating, by the connector hub, proxy provisioning channel credentials;

deploying, by the connector hub, an authentication proxy instance in the connection factory; and

transmitting, by the connector hub, the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein establishing the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

3. The method of claim 1, wherein establishing the second communication channel between the authentication proxy instance and the cloud service broker interface includes transmitting an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

4. The method of claim 1, further comprising:

generating, by the connector hub, the provider provisioning channel credentials corresponding to the cloud service provider; and

generating, by the connector hub, the broker provisioning channel credentials corresponding to the cloud service broker.

5. The method of claim 4, further comprising receiving, by the connector hub, an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein generating the broker provisioning channel credentials for the cloud service broker comprises generating the broker provisioning channel credentials in response to having received the API connector provision notification.

6. The method of claim 4, further comprising receiving, by the connector hub, an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein generating the provider provisioning channel credentials comprises generating the provider provisioning channel credentials in response to having received the indication.

7. The method of claim 4, further comprising:

storing, by the connector hub, the provider provisioning channel credentials in a credentials database of the connector hub;

associating, by the connector hub, the provider provisioning channel credentials with the cloud service provider in the credentials database;

storing, by the connector hub, the broker provisioning channel credentials in the credentials database in the credentials database; and

associating, by the connector hub, the broker provisioning channel credentials with a cloud service broker.

8. The method of claim 1, wherein establishing the second communication channel between the API connector instance and the cloud service broker interface includes transmitting an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

9. One or more computer-readable storage media comprising a plurality of instructions stored thereon that in response to being executed cause a connector hub of a marketplace computing device to:

deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;

transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

10. The one or more computer-readable storage media of claim 9, wherein the plurality of instructions further cause the connector hub to:

generate proxy provisioning channel credentials;

deploy an authentication proxy instance in the connection factory; and

transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

11. The one or more computer-readable storage media of claim 9, wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

12. The one or more computer-readable storage media of claim 9, wherein the plurality of instructions further cause the connector hub to:

generate the provider provisioning channel credentials corresponding to the cloud service provider; and

generate the broker provisioning channel credentials corresponding to the cloud service broker.

13. The one or more computer-readable storage media of claim 12, wherein the plurality of instructions further cause the connector hub to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification.

14. The one or more computer-readable storage media of claim 12, wherein the plurality of instructions further cause the connector hub to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication.

15. The one or more computer-readable storage media of claim 12, wherein the plurality of instructions further cause the connector hub to:

store the provider provisioning channel credentials in a credentials database of the connector hub;

associate the provider provisioning channel credentials with the cloud service provider in the credentials database;

store the broker provisioning channel credentials in the credentials database in the credentials database; and

associate the broker provisioning channel credentials with a cloud service broker.

16. The one or more computer-readable storage media of claim 9, wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

17. A connector hub of a marketplace computing device for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, wherein the cloud service marketplace includes a marketplace computing device, the marketplace computing device comprising:

a CPU; and

a memory having stored therein a plurality of instructions that when executed by the processor cause a connector hub of the marketplace computing device to;

deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;

transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

18. The marketplace computing device of claim 17, wherein the one or more processors are further configured to execute the instructions to:

generate proxy provisioning channel credentials;

deploy an authentication proxy instance in the connection factory; and

transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

19. The marketplace computing device of claim 17, wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

20. The marketplace computing device of claim 17, wherein the one or more processors are further configured to execute the instructions to:

generate the provider provisioning channel credentials corresponding to the cloud service provider; and

generate the broker provisioning channel credentials corresponding to the cloud service broker.

21. The marketplace computing device of claim 20, wherein the one or more processors are further configured to execute the instructions to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification.

22. The marketplace computing device of claim 20, wherein the one or more processors are further configured to execute the instructions to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication.

23. The marketplace computing device of claim 20, wherein the one or more processors are further configured to execute the instructions to:

store the provider provisioning channel credentials in a credentials database of the connector hub;

associate the provider provisioning channel credentials with the cloud service provider in the credentials database;

store the broker provisioning channel credentials in the credentials database in the credentials database; and

associate the broker provisioning channel credentials with a cloud service broker.

24. The marketplace computing device of claim 17, wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.