Distributed hybrid model for security as a service
An apparatus includes a network interface and a processor. The network interface receives an application programming interface (API) request, transmits a customer management request including an identifier of the customer apparatus, and receives a customer management response including a policy. The processor performs a security service on the API request, at least in part based on the policy.
1 . An apparatus to distribute security services between a vendor infrastructure and a customer infrastructure, the apparatus comprising:
a network interface to receive, from the vendor infrastructure associated with a security service in a hybrid cloud, a policy for performing the security service across the hybrid cloud;
executable instructions; and
one or more processor circuits to be programmed by the executable instructions to:
cause the network interface to transmit a service request to the vendor infrastructure to process non-sensitive data at the vendor infrastructure, the non-sensitive data included in an application programming interface (API) request for the security service;
maintain sensitive data included in the API request within the customer infrastructure without transferring the sensitive data outside the customer infrastructure; and
process, at the customer infrastructure, the sensitive data with the security service based on (1) the policy and (2) a service result generated at the vendor infrastructure based on the service request, the sensitive data included in the API request.
2 . The apparatus of claim 1 , wherein the service result is a first service result, and the network interface is to:
transmit the service request to the vendor infrastructure, the service request including the non-sensitive data;
receive a service response from the vendor infrastructure, the service response including the first service result; and
transmit an API response, the API response based on a second service result generated by the security service.
3 . The apparatus of claim 2 , wherein at least one of the one or more processor circuits is to separate the API request into the non-sensitive data and the sensitive data based on the policy.
4 . The apparatus of claim 1 , wherein the network interface is to transmit a policy request based on a receipt of the API request.
5 . The apparatus of claim 1 , wherein:
at least one of the one or more processor circuits is to produce a client artifact based on processing the sensitive data with the security service; and
the network interface is to transmit the client artifact.
6 . The apparatus of claim 1 , wherein the non-sensitive data at least one of a workload configuration or a checksum of a file, the workload configuration including at least one of an allowed length of a password, whether special characters are allowed for the password, or which of the special characters are allowed for the password.
7 . The apparatus of claim 1 , wherein the sensitive data includes at least one of an internet protocol address, a tag, a user identifier, or personally identifiable information.
8 . A method to distribute security services between a vendor infrastructure and a customer infrastructure, the method comprising:
receiving, from the vendor infrastructure associated with a security service in a hybrid cloud, a policy for performing the security service across the hybrid cloud;
transmitting a service request to the vendor infrastructure to process non-sensitive data at the vendor infrastructure, the non-sensitive data included in an application programming interface (API) request for the security service;
maintaining sensitive data included in the API request within the customer infrastructure without transferring the sensitive data outside the customer infrastructure; and
processing, at the customer infrastructure, the sensitive data with the security service based on (1) the policy and (2) a service result generated at the vendor infrastructure based on the service request.
9 . The method of claim 8 , wherein the service result is a first service result, and the method further includes:
transmitting the service request to the vendor infrastructure, the service request including the non-sensitive data;
receiving a service response from the vendor infrastructure, the service response including the first service result; and
transmitting an API response, the API response based on a second service result generated by the security service.
10 . The method of claim 9 , further including separating the API request into the non-sensitive data and the sensitive data based on the policy.
11 . The method of claim 8 , further including transmitting a policy request based on a receipt of the API request.
12 . The method of claim 8 , further including:
producing a client artifact based on processing the sensitive data with the security service; and
transmitting the client artifact.
13 . The method of claim 8 , wherein the non-sensitive data at least one of a workload configuration or a checksum of a file, the workload configuration including at least one of an allowed length of a password, whether special characters are allowed for the password, or which of the special characters are allowed for the password.
14 . The method of claim 8 , wherein the sensitive data includes at least one of an internet protocol address, a tag, a user identifier, or personally identifiable information.
15 . A non-transitory computer-readable medium comprising executable instructions that cause one or more processor circuits to:
receive, from a vendor infrastructure associated with a security service in a hybrid cloud, a policy for performing the security service across the hybrid cloud;
cause transmission of a service request to the vendor infrastructure to process non-sensitive data at the vendor infrastructure, the non-sensitive data included in an application programming interface (API) request for the security service;
maintain sensitive data included in the API request within a customer infrastructure without transferring the sensitive data outside the customer infrastructure; and
process, at the customer infrastructure, the sensitive data with the security service based on (1) the policy and (2) a service result generated at the vendor infrastructure based on the service request.
16 . The non-transitory computer-readable medium of claim 15 , wherein the service result is a first service result, and the executable instructions cause at least one of the one or more processor circuits to:
cause transmission of the service request to the vendor infrastructure, the service request including the non-sensitive data;
access a service response from the vendor infrastructure, the service response including the first service result; and
cause transmission of an API response, the API response based on a second service result generated by the security service.
17 . The non-transitory computer-readable medium of claim 16 , wherein the executable instructions cause at least one of the one or more processor circuits to separate the API request into the non-sensitive data and the sensitive data based on the policy.
18 . The non-transitory computer-readable medium of claim 15 , wherein the executable instructions cause at least one of the one or more processor circuits to transmit a policy request based on a receipt of the API request.
19 . The non-transitory computer-readable medium of claim 15 , wherein the non-sensitive data at least one of a workload configuration or a checksum of a file, the workload configuration including at least one of an allowed length of a password, whether special characters are allowed for the password, or which of the special characters are allowed for the password.
20 . The non-transitory computer-readable medium of claim 15 , wherein the sensitive data includes at least one of an internet protocol address, a tag, a user identifier, or personally identifiable information.