Systems and methods for API routing and security

Patent metadata

Field	Value
Publication number	US-10834054-B2
Application number	US-201615164555-A
Country	US
Kind code	B2
Filing date	May 25, 2016
Priority date	May 27, 2015
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

The invention provides methods, computer program products, proxies and proxy clusters configured for forwarding, routing and/or load balancing of client requests or messages between multiple different APIs and/or multiple instances of an API. The invention further provides for efficient session information based routing of client requests for a target API, wherein multiple instances of the target API are simultaneously implemented across one or more API servers. The invention additionally enables separation of a control plane (i.e. control logic) and run time execution logic within a data plane within proxies in a proxy cluster, and also enables implementation of a plurality of data planes within each proxy—thereby ensuring security, high availability and scalability. An invention embodiment additionally implements two-stage rate limiting protection for API servers combining rate limiting between client and each proxy, and rate limiting between a proxy cluster and a server backend.

First claim

The invention claimed is:

1. A proxy configured for routing messages to a plurality of Application Programming Interfaces (APIs), the proxy comprising:
a memory configured to store a plurality of API characteristics data definitions, each API characteristics data definition from the plurality of API characteristics data definitions being a data file that is uniquely associated with an API from the plurality of APIs; and
a processor operatively coupled to the memory, the processor configured to:
extract, from a message received from a client device, parameter information including a name of a target API from the plurality of APIs;
select, from among the plurality of API characteristics data definitions, an API characteristics data definition that includes the name of the target API;
compare the parameter information extracted from the message and information contained within the API characteristics data definition to determine whether the parameter information matches the information contained within the API characteristics data definition;
identify, in response to the parameter information matching the information contained within the API characteristics data definition, a plurality of API servers each hosting a different instance of the target API;
select an instance of the target API hosted on an API server from the plurality of API servers by:
in response to determining that the message is a non-session based message based on session data stored in the memory, selecting the instance of the target API hosted on the API server having a number of session users lower than a number of session users for each remaining API server from the plurality of API servers, and
in response to determining that the message is a session based message based on the session data:
in response to determining that the client device has been assigned to the API server, selecting the instance of the target API hosted on the API server; and
in response to determining that the client device has not been assigned to the API server, selecting the instance of the target API hosted on the API server having the number of session users lower than a number of session users for each remaining API server from the plurality of API servers; and

transmit the message to the instance of the target API.

2. The proxy as claimed in claim 1 , wherein the parameter information includes one or more of cookie information, token information, communication protocol information, protocol method information, and content type.

3. The proxy as claimed in claim 1 , wherein:
the processor is configured to identify the plurality of API servers based on a plurality of IP addresses and a plurality of TCP ports included within the API characteristics data definition,
the processor is configured to select the instance of the target API by selecting an IP address from the plurality of IP addresses and a TCP port from the plurality of TCP ports.

4. The proxy as claimed in claim 3 , wherein the processor is configured to transmit the message to the instance of the target API based at least on the IP address and the TCP port.

5. The proxy as claimed in claim 1 , wherein the processor is configured to implement (i) a control plane including a processor implemented control process associated with configuring and synchronizing the plurality of API characteristics data definitions, and (ii) one or more data planes, each data plane from the one or more data planes including a discrete processor implemented balancer process associated with routing the messages.

6. The proxy as claimed in claim 5 , wherein the processor implementing the control plane is configured for one or more of:
(i) receiving a new API characteristics data definition,
(ii) validating the new API characteristics data definition based on at least one of a prescribed API characteristics data definition schema or one or more validation rules,
(iii) persisting the plurality of API characteristics data definitions, the plurality of API characteristics data definitions including one or more API characteristics data definitions that have been validated,
(iv) synchronizing the plurality of API characteristics data definitions with pluralities of API characteristics data definitions of a plurality of proxies so that each proxy from the plurality of proxies has access to the plurality of API characteristics data definitions,
(v) monitoring and synchronizing session data including cookies, or
(vi) monitoring the one or more data planes for a failure event.

7. The proxy as claimed in claim 5 , wherein the processor implementing the one or more data planes is configured for one or more of:
(i) the selecting the API characteristics data definition including (a) comparing data parsed from the message with data in the plurality of API characteristics data definitions, and (b) identifying the API characteristics data definition uniquely associated with the target API,
(ii) implementing one or more routing or load balancing decisions based on the information identified from within the API characteristics data definition, the implementing including the identifying of the information from within the API characteristics data definition and the transmitting the message,
(iii) implementing authentication steps for authenticating the message,
(iv) implementing rate limiting based security for one or more API servers, or
(v) implementing one or more load balancing decisions based on cookies or session data.

8. The proxy as claimed in claim 5 , wherein the processor is configured to implement asynchronous message based inter process communication (IPC) between the control plane and each data plane from the one or more data planes.

9. The proxy as claimed in claim 5 , wherein at least one data plane from the one or more data planes is an asynchronous data plane.

10. The proxy as claimed in claim 5 , wherein the one or more data planes includes a discrete data plane uniquely associated with each protocol supported by the proxy or each TCP port supported by the proxy.

11. The proxy as claimed in claim 5 , wherein at least one data plane from the one or more data planes is associated with a plurality of sub-processes, the processor configured to initialize the plurality of sub-processes to simultaneously handle routing of the messages.

12. The proxy as claimed in claim 1 , wherein the processor is further configured to authenticate the message based on security data stored in the memory, the security data including one or more of a cipher suite, a digital certificate, a session key, and an asymmetric or symmetric cipher,
the processor configured to transmit the message after authenticating the message.

13. A proxy configured for routing messages to a plurality of APIs, the proxy configured to be included in a proxy cluster including a plurality of proxies, the proxy including:
a memory configured to store a plurality of API characteristics data definitions, each API characteristics data definition from the plurality of API characteristics data definitions being a data file that is uniquely associated with an API from the plurality of APIs; and
a processor operatively coupled to the memory, the processor configured to:
extract, from a message received from a client device, parameter information including a name of a target API from the plurality of APIs and a hostname associated with the target API;
select, from among the plurality of API characteristics data definitions, an API characteristics data definition based on the name of the target API and the hostname, the API characteristics data definition uniquely associated with the target API and includin

Assignees

• Ping Identity Corp

Inventors

• Subbarayan Udayakumar
• Harguindeguy Bernard
• Gopalakrishnan Anoop Krishnan
• Poonthiruthi Abdu Raheem

Classifications

• H04L67/1014

  based on the content of a request · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L67/60

  Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) · CPC title

• H04L67/01

  Protocols · CPC title

• H04L67/1068

  Discovery involving direct consultation or announcement among potential requesting and potential source peers · CPC title