Governing access to third-party application programming interfaces

Patent metadata

Field	Value
Publication number	US-11023300-B2
Application number	US-201916427465-A
Country	US
Kind code	B2
Filing date	May 31, 2019
Priority date	Jun 30, 2017
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

Techniques for governing access to third-party application programming interfaces (API's) are disclosed. A proxy service exposes an API configured to receive requests, from user-facing services, to perform functions of backend services. The proxy service stores a usage policy that defines a criterion that is (a) different from any authorization criterion and (b) associated with using a function of a backend service. The proxy service receives a request to perform the function of the first backend service for a user-facing service and determines that the request does not satisfy the usage policy. Based on determining that the request does not satisfy the usage policy, the proxy service refrains from accessing the backend service to perform the function responsive to the request, and transmits an alert to the user-facing service indicating that the request does not satisfy the usage policy.

First claim

What is claimed is:

1. One or more non-transitory machine-readable
media storing instructions which, when executed by one or more processors, cause:
exposing, by a proxy service operating independently of a plurality of user-facing services and a plurality of backend services, an application programming interface (API) configured to receive requests from the plurality of user-facing services to perform a plurality of functions, respectively, of the plurality of backend services upon authorization of a client accessing the plurality of user-facing services;
storing, by the proxy service, a first usage policy implemented by a first plug-in application recipe (PIAR), the first PIAR defining at least a first trigger condition and a first set of one or more actions to be performed in response to detecting the first trigger condition, the first trigger condition being (a) different from any authorization criterion and the first set of one or more actions (b) associated with using a first function of a first backend service in the plurality of backend services;
receiving, by the proxy service via the API, a first request to perform the first function of the first backend service for a first user-facing service in the plurality of user-facing services;
determining, upon application of the PIAR by the proxy service that a condition associated with the first request meets the first trigger condition of the PIAR;
responsive to determining the first trigger condition of the PIAR has been met, executing a first action of the first set of one or more actions that prevents, via the proxy service, the first request from accessing the first backend service to perform the first function responsive to the first request; and
executing a second action of the first set of one or more actions by transmitting, via the proxy service to the first user-facing service, an alert indicating that the first request does not satisfy the first usage policy.

2. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
determining, by the proxy service, that the first usage policy is overridable,
wherein the alert comprises information associated with overriding the first usage policy.

3. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
subsequent to executing the second action by transmitting the alert to the first user-facing service: receiving, by the proxy service from the first user-facing service, an instruction to override the first usage policy for the first request that does not satisfy the first usage policy;
based on the instruction to override the first usage policy for the first request: accessing, by the proxy service, the first backend service to perform the first function responsive to the first request that does not satisfy the first usage policy.

4. The one or more media of claim 3 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service via the API, a second request to perform the first function of the first backend service for the first user-facing service;
determining, by the proxy service, that the second request does not satisfy the first usage policy;
based on the instruction to override the first usage policy for the first request: accessing, by the proxy service, the first backend service to perform the first function responsive to the second request that does not satisfy the first usage policy.

5. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service via the API, a second request to perform the first function of the first backend service for the first user-facing service;
determining, by the proxy service, that the second request satisfies the first usage policy;
based at least on determining that the second request satisfies the first usage policy: accessing, by the proxy service, the first backend service to perform the first function responsive to the second request.

6. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service via the API, a second request to perform the first function of the first backend service for a second user-facing service in the plurality of user-facing services;
determining, by the proxy service, that the second request satisfies the first usage policy;
based at least on determining that the second request satisfies the first usage policy: accessing, by the proxy service, the first backend service to perform the first function responsive to the second request.

7. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
storing, by the proxy service, a second usage policy implemented by a second plug-in application recipe (PIAR), the second PIAR defining at least a second trigger condition and a second set of one or more actions (a) different from any authorization criterion and the second set of one or more actions (b) associated with using a second function of a second backend service in the plurality of backend services;
receiving, by the proxy service via the API, a second request to perform the second function of the second backend service for a second user-facing service in the plurality of user-facing services;
determining, by the proxy service, that the second request satisfies the second usage policy;
based at least on determining that the second request satisfies the second usage policy: accessing, by the proxy service, the second backend service to perform the second function responsive to the second request.

8. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
storing, by the proxy service, a second usage policy implemented by a second plug-in application recipe (PIAR), the second PIAR defining at least a second trigger condition and a second set of one or more actions to be performed in response to detecting the second trigger condition, the second trigger condition being (a) different from any authorization criterion and the second set of one or more actions (b) associated with using a second function of the first backend service.

9. The one or more media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
receiving, by the proxy service, user input configuring the first usage policy,
wherein storing the first usage policy is performed responsive to receiving the user input.

10. The one or more media of claim 1 , wherein the first usage policy is applicable to the first user-facing service and not applicable to a second user-facing service in the plurality of user-facing services.

11. The one or more media of claim 1 , wherein the first usage policy is applicable to a first account of the first user-facing service and not applicable to a second account of the first user-facing service.

12. The one or more media of claim 1 , wherein the first usage policy enforces a legal requirement associated with one or more of: the proxy service; the first user-facing service;
or the first backend service.

13. The one or more media of claim 1 , wherein the first usage policy is configured to prevent a financial cost associated with the first function of the first backend service.

14. The one or more media of claim 13 , wherein the financial cost is associated with an overage charge policy of the first backend service.

Assignees

• Oracle Int Corp

Inventors

• Chang Tuck
• Zhang Zhengming

Classifications

• H04L63/0281

  Proxies · CPC title

• G06F9/547 Primary

  Remote procedure calls [RPC]; Web services · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title