Granted Patent B2

US 12,206,665 · App. 17/659,419 · Granted Jan 21, 2025

Inventors: Maxim Kuzkin (Irvine, CA); Aleksandr Khaerov (Moscow, RU); Vladimir Zatsepin (Mytishchi, RU); Vladimir Grebenschikov (Moscow, RU)

Assignee: CloudBlue LLC

H04L63/0884G06F8/36G06F8/60H04L63/083H04L63/18G06F16/22H04L2463/082

Abstract

Claims (68)

1. A method for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, the method comprising:

receiving, by a connector hub, an API connector provision notification from the cloud service marketplace, the API connector provision notification comprising an identifier of a cloud service broker;

generating, by the connector hub, broker provisioning channel credentials corresponding to the cloud service broker associated with the API connector provision notification and based on the identifier of the cloud service broker;

deploying, by a connector hub of a marketplace computing device, an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of a cloud service provider;

transmitting, by the connector hub, provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmitting, by the connector hub, the broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

the establishing of, by the connector hub, a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein establishing the provisioning channel comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

2. The method of claim 1 , further comprising:

generating, by the connector hub, proxy provisioning channel credentials; deploying, by the connector hub, an authentication proxy instance in the connection factory; and

transmitting, by the connector hub, the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein the establishing of the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

3. The method of claim 2 , wherein the establishing of the second communication channel between the authentication proxy instance and the cloud service broker interface includes transmitting an address of the authentication proxy instance to the cloud service broker interface,

wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

4. The method of claim 1 , wherein the generating of the broker provisioning channel credentials for the cloud service broker comprises generating the broker provisioning channel credentials in response to having received the API connector provision notification.

5. The method of claim 1 , further comprising:

receiving, by the connector hub, an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in a cloud service broker marketplace; and

generating, by the connector hub, the provider provisioning channel credentials corresponding to the cloud service provider in response to having received the indication.

6. The method of claim 5 , further comprising:

storing, by the connector hub, the provider provisioning channel credentials in a credentials database of the connector hub;

associating, by the connector hub, the provider provisioning channel credentials with the cloud service provider in the credentials database;

storing, by the connector hub, the broker provisioning channel credentials in the credentials database; and

associating, by the connector hub, the broker provisioning channel credentials with the cloud service broker.

7. The method of claim 2 , wherein the establishing of the second communication channel between the API connector instance and the cloud service broker interface includes transmitting an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

8. One or more non-transitory computer-readable storage media comprising a plurality of instructions stored thereon that in response to being executed cause a connector hub of a marketplace computing device to:

receive an API connector provision notification from the cloud service marketplace, the API connector provision notification comprising an identifier of a cloud service broker;

generate broker provisioning channel credentials corresponding to the cloud service broker associated with the API connector provision notification and based on the identifier of the cloud service broker;

deploy an Application Programming Interface (API) connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;

transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmit the broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

9. The one or more non-transitory computer-readable storage media of claim 8 , wherein the plurality of instructions further cause the connector hub to:

generate proxy provisioning channel credentials;

deploy an authentication proxy instance in the connection factory; and

transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

10. The one or more non-transitory computer-readable storage media of claim 9 , wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

11. The one or more non-transitory computer-readable storage media of claim 8 , wherein the plurality of instructions further cause the connector hub generate the broker provisioning channel credentials in response to having received the API connector provision notification.

12. The one or more non-transitory computer-readable storage media of claim 8 , wherein the plurality of instructions further cause the connector hub to:

receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in a cloud service broker marketplace; and

generate the provider provisioning channel credentials in response to having received the indication.

13. The one or more non-transitory computer-readable storage media of claim 12 , wherein the plurality of instructions further cause the connector hub to:

store the provider provisioning channel credentials in a credentials database of the connector hub;

associate the provider provisioning channel credentials with the cloud service provider in the credentials database;

store the broker provisioning channel credentials in the credentials database; and associate the broker provisioning channel credentials with the cloud service broker.

14. The one or more non-transitory computer-readable storage media of claim 9 , wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

15. A marketplace computing device for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, wherein the cloud service marketplace includes a marketplace computing device, the marketplace computing device comprising:

a CPU having one or more processors; and

a memory having stored therein a plurality of instructions that when executed by the one or more processors of the CPU cause a connector hub of the marketplace computing device to:

receive an API connector provision notification from the cloud service marketplace, the API connector provision notification comprising an identifier of a cloud service broker;

generate broker provisioning channel credentials corresponding to the cloud service broker associated with the API connector provision notification and based on the identifier of the cloud service broker;

deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of a cloud service provider;

transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;

transmit the broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and

establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.

16. The marketplace computing device of claim 15 , wherein the one or more processors are further configured to execute the instructions to:

generate proxy provisioning channel credentials;

deploy an authentication proxy instance in the connection factory; and

transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,

wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.

17. The marketplace computing device of claim 16 , wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

18. The marketplace computing device of claim 15 , wherein the one or more processors are further configured to execute the instructions to:

receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in a cloud service broker marketplace; and

generate the provider provisioning channel credentials in response to having received the indication.

19. The marketplace computing device of claim 18 , wherein the one or more processors are further configured to execute the instructions to:

store the provider provisioning channel credentials in a credentials database of the connector hub;

associate the provider provisioning channel credentials with the cloud service provider in the credentials database;

store the broker provisioning channel credentials in the credentials database; and associate the broker provisioning channel credentials with the cloud service broker.

20. The marketplace computing device of claim 16 , wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.

Assignments (9)