Application programming interface (API) hub

Patent metadata

Field	Value
Publication number	US-10331505-B2
Application number	US-201615199847-A
Country	US
Kind code	B2
Filing date	Jun 30, 2016
Priority date	Jun 30, 2016
Publication date	Jun 25, 2019
Grant date	Jun 25, 2019

Abstract

Embodiments are directed to a system for controlling access to remote services, comprising an application programming interface (API) hub configured to provide an interface between a client application and one or more remote services. The client application accesses the API hub using a common data protocol, such as OData, that is not associated with the remote services. The API hub selects a connectors based upon the targeted remote service and maps a user context associated with messages received from the client application to remote service credentials associated with the targeted remote service.

First claim

What is claimed is:

1. A system for controlling access to remote services, comprising:
an application programming interface (API) hub configured to provide a first interface to a client application and to provide a second interface to one or more remote services, wherein the first interface configured to communicate messages using a common data protocol that is not associated with the one or more remote services, and wherein the second interface comprises API connectors that are selected based upon a targeted one of the remote services;
the API hub configured to map a user context associated with messages received on the first interface to remote service credentials associated with the targeted one of the remote services, wherein mapping comprises transforming user credentials associated with the user context into remote service credentials, the remote service credentials required to connect, using an API connector associated with the targeted one of the remote services, to the targeted one of the remote services.

2. The system of claim 1 , wherein the API hub is a component of a distributed computing network, and wherein the client application is running on a device remote from the distributed computing network.

3. The system of claim 1 , wherein the API hub is a component of a distributed computing network, and wherein the client application is running on a virtual machine on the distributed computing network.

4. The system of claim 1 , further comprising:
an access control service coupled to the API hub, the access control service configured to identify to the API hub whether a particular user has access to a connection to the targeted one of the remote services.

5. The system of claim 1 , wherein the API hub is further configured to establish a security boundary between the client application and the one or more remote services, wherein establishing the security boundary restricts access, of the client application, to the remote service credentials.

6. The system of claim 1 , wherein the API hub is further configured to establish a security boundary between the client application and the one or more remote services, wherein establishing the security boundary restricts access of the one or more remote services, to the user context associated with the messages received on the first interface.

7. The system of claim 1 , wherein the API hub is configured to enforce quota, rate limits, or usage parameters for accessing the one or more remote services, wherein the one or more remote services comprise services selected from storage services, database services, messaging services, Software as a Service (SaaS) platforms, collaboration and document management platforms, and customer relationship management (CRM) services.

8. The system of claim 1 , wherein the remote service credentials comprise security tokens associated with a specific service and a specific user.

9. A computer-implemented method for controlling access to remote services, comprising:
receiving messages using a common data protocol at an application programming interface (API) hub over a first interface to a client application;
mapping, by the API hub, a user context associated with the messages received on the first interface to remote service credentials associated with a targeted remote service, wherein mapping comprises transforming user credentials associated with the user context into the remote service credentials, the remote service credentials required to connect, using an API connector associated with the targeted remote service, to the targeted remote service;
selecting, by the API hub, the API connector associated with the targeted remote service; and
communicating the messages to the targeted remote service using the API connector.

10. The method of claim 9 , wherein the common data protocol is not associated with the remote services; and wherein the API connector is associated with a data protocol that is specific to the targeted remote service.

11. The method of claim 9 , wherein the messages comprise Create Read Update Delete (CRUD) operations.

12. The method of claim 9 , wherein the API hub is a component of a distributed computing network, and wherein the client application is running on a device remote from the distributed computing network.

13. The method of claim 9 , wherein the API hub is a component of a distributed computing network, and wherein the client application is running on a virtual machine on the distributed computing network.

14. The method of claim 9 , further comprising:
receiving, at the API hub, information from an access control service identifying whether a particular user has access to a connection to the targeted one of the remote services.

15. The method of claim 9 , wherein the API hub is further configured to establish a security boundary between the client application and the one or more remote services, wherein establishing the security boundary restricts access, of the client application, to the remote service credentials.

16. The method of claim 9 , wherein the API hub is further configured to establish a security boundary between the client application and the one or more remote services, wherein establishing the security boundary restricts access of the one or more remote services, to the user context associated with the messages received on the first interface.

17. The method of claim 9 , wherein the API hub is configured to enforce quota, rate limits, or usage parameters for accessing the one or more remote services, wherein the one or more remote services comprise services selected from storage services, database services, messaging services, Software as a Service (SaaS) platforms, collaboration and document management platforms, and customer relationship management (CRM) services.

18. The method of claim 9 , wherein the remote service credentials comprise security tokens associated with a specific service and a specific user.

19. A computer system, comprising:
one or more processors;
system memory;
one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the processors to perform a method for controlling access to remote services, the processor operating to:
receive a message using a common data protocol at an application programming interface (API) hub over a first interface to a client application;
map, by the API hub, a user context associated with the message received on the first interface to remote service credentials associated with a targeted remote service, wherein mapping comprises transforming user credentials associated with the user context into the remote service credentials, the remote service credentials required to connect, using an API connector associated with the targeted remote service, to the targeted remote service;
select, by the API hub, an API connector for the targeted remote service; and
communicate the message to the targeted remote service using the API connector.

20. The computer system of claim 19 , wherein the API hub establishes a security boundary between the client application and the targeted remote service, wherein establishing the security boundary restricts access, of the client application, to the remote service credentials; or
wherein the API hub establishes a security boundary between the client application and the targeted remote service, wherein establishing the security boundary restricts access, of the one or more remote services, to the user contex

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Aguilar Mares Carlos
• Alam Bilal
• Lamanna Charles
• Stall J Michael
• Iliev Galin

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F9/547 Primary

  Remote procedure calls [RPC]; Web services · CPC title

• G06F9/54

  Interprogram communication · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/50

  Allocation of resources, e.g. of the central processing unit [CPU] · CPC title