Securing application programming interfaces (apis) through infrastructure virtualization

Patent metadata

Field	Value
Publication number	US-2016105408-A1
Application number	US-201414512041-A
Country	US
Kind code	A1
Filing date	Oct 10, 2014
Priority date	Oct 10, 2014
Publication date	Apr 14, 2016
Grant date	—

Abstract

Methods and systems for the secure exchange of data within a network are provided. A method includes, registering, by a computer system, one or more stubs installed on at least one computing device. The method further includes constructing a virtual routing table using endpoint address information of the one or more stubs. The method further transmitting a portion of the virtual routing table to the one or more stubs such that the one or more stubs are configured to create a virtual pipe for exchanging data between the at least one computing device and at least one other computing device using the portion of the virtual routing table.

First claim

What is claimed is:

1 . A method of managing one or more computing devices, comprising:
registering, by a computer system, one or more stubs installed on at least one computing device; constructing a virtual routing table using endpoint address information of the one or more stubs; and transmitting a portion of the virtual routing table to the one or more stubs such that the one or more stubs are configured to create a virtual pipe for exchanging data between the at least one computing device and at least one other computing device using the portion of the virtual routing table.

2 . The method of claim 1 , wherein the endpoint address information comprises all endpoint addresses necessary to carry out functions of one or more applications installed on the at least one other computing device.

3 . The method of claim 1 , further comprising determining one or more rules to be applied to the one or more stubs.

4 . The method of claim 3 , further comprising transmitting the one or more rules to the one or more stubs.

5 . The method of claim 4 , wherein the one or more rules instruct the one or more stubs to apply a level of encryption for the data.

6 . The method of claim 4 , wherein the one or more rules instruct the one or more stubs to authenticate the at least one computing device and the at least one other computing device.

7 . The method of claim 1 , further comprising at least one of: pausing, resuming, or removing execution of the one or more stubs.

8 . The method of claim 1 , wherein a service provider at least one of creates, maintains, and supports the computer system.

9 . The method of claim 1 , further comprising deploying a system for creating the virtual pipe, comprising providing a computer infrastructure operable to perform the steps of claim 1 .

10 . A computer program product for creating a virtual pipe for exchanging data comprising computer readable program instructions stored on non-transitory computer readable storage medium, the computer readable program instructions causing a computing device to:
initializing a stub at a first computing device; receiving at least one endpoint address at the stub from a management console; establishing a virtual pipe with a second computing device using the at least one endpoint address, the establishing the virtual pipe includes creating an authenticated and secured connection between the first computing device and the second computing device; and exchanging data over the virtual pipe.

11 . The computer program product of claim 10 , further comprising receiving a web service call from an application at the stub.

12 . The computer program product of claim 11 , wherein the exchanging of the data over the virtual pipe is one of a fully encrypted or selectively encrypted exchange.

13 . The computer program product of claim 10 , further comprising monitoring and reporting network health information to the management console, the monitoring and reporting comprising:
establishing a secure connection between the stub and the management console; receiving one or more rules at the stub from the management console, wherein the one or more rules define the network health information to be monitored by the stub; recording the network health information at the stub; and sending the network health information from the stub to the management console.

14 . The computer program product of claim 10 , further comprising virtualizing intermediary devices and managing the exchanging of the data over the virtual pipe directly between the first computing device and the second computing device without any intermediary devices.

15 . The computer program product of claim 10 , further comprising handling authentication, encryption, and load balancing of the exchanging of the data for an application.

16 . A computer system for generating a virtual pipe for exchanging data, comprising:
a hardware memory device that stores program instructions; a processor that executes the program instructions and causes the computer system to:
register with a management console;
receive rules from the management console;
intercept a web service call from an application;
determine an endpoint address for the intercepted web service call based on the received rules;
determine a key corresponding to the endpoint address based on the received rules; and
create a virtual pipe using the endpoint address and the key to exchange data directly with a computing device using the virtual pipe.

17 . The computer system of claim 16 , wherein the web service call is handled by a stub.

18 . The computer system of claim 17 , wherein the stub is responsible for encrypting and routing the data over the virtual pipe.

19 . The computer system of claim 18 , wherein the program instructions are further operable to cause the computer system to handle authentication and load balancing of the exchanging of the data for the application making the web service call.

20 . The computer system of claim 19 , wherein the program instructions are further operable to cause the computer system to monitor and report network health information to the management console, the monitoring and reporting comprising:
establishing a secure connection between the stub and the management console; receiving one or more rules at the stub from the management console, wherein the one or more rules define the network health information to be monitored by the stub; recording the network health information at the stub; and sending the network health information from the stub to the management console.

Assignees

• Adp Llc

Inventors

• Cooper Thomas A
• Larosa Vincent J

Classifications

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title