Application programming interface wall

Patent metadata

Field	Value
Publication number	US-9729506-B2
Application number	US-201414466779-A
Country	US
Kind code	B2
Filing date	Aug 22, 2014
Priority date	Aug 22, 2014
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

Application programming interfaces (APIs) can be unintentionally exposed and allow for potentially undesirable use of corporate resources. An API call filtering system configured to monitor API call requests received via an endpoint and API call responses received via a supporting service of an API or web service. The API call filtering system enables enterprises to improve their security posture by identifying, studying, reporting, and securing their APIs within their enterprise network.

First claim

What is claimed is:

1. An application programming interface (API) call filtering system to filter API call requests received, via a network, from a device that is network-connected and configured to run endpoint application hardware and/or software, to secure an API service that accepts API call requests and provides API call responses thereto, the system comprising:
at least one computing device configured to implement one or more services, wherein the one or more services are configured to:
a) monitor, at an API filter, a plurality of API call requests received from one or more endpoint application directed to a server configured to provide, at least in part, the API service;
b) monitor authentication methods of the plurality of API call requests;
c) compile authentication method information over the plurality of API call requests;
d) compile performance indicators of the plurality of API call requests;
e) analyze the compiled performance indicators;
f) create at least one report based at least in part, on the compiled performance indicators and compiled authentication method information;
g) modify an authentication method of at least one incoming API call request in response to a security team input following an output of the at least one report, to form a modified incoming API call request that is processable by the server as the server is configured for the incoming API call request, wherein modifying an authentication method comprises, for at least some incoming API call requests, creating a requirement that the at least one incoming API call request satisfy an authentication test that the at least one incoming API call request would not have otherwise had to satisfy; and
h) send the modified incoming API call request to the server.

2. The API call filtering system of claim 1 , wherein the device is a user device or a machine-to-machine device.

3. The API call filtering system of claim 1 , wherein the API filter initially includes no information of the API to which the plurality of API call requests are transmitted.

4. The API call filtering system of claim 1 , wherein the performance indicators include a frequency, a velocity, a time of day, a geo-location, or an authentication indicator related to the plurality of API call requests.

5. The API call filtering system of claim 1 , wherein the at least one report includes analysis of the performance indicators and at least one recommendation of an action or non-action to take in response to each of at least some of the incoming API call requests.

6. The API call filtering system of claim 1 , wherein the one or more services are further configured to:
obtain the performance indicators;
determine identification criteria based, at least in part, on the performance indicators; and
identify, using the identification criteria, the API to which the plurality of API call requests are transmitted.

7. The API call filtering system of claim 1 , wherein the one or more services are further configured to:
create an access control list (ACL) for the API; and
change access permissions in the ACL for the API, wherein the access permission changes include modifying access to the API, limiting access to the API, or blocking access to the API.

8. The API call filtering system of claim 7 , wherein limiting access to the API comprises at least throttling or reducing throughput.

9. The API call filtering system of claim 7 , wherein the one or more services are further configured to change the access permissions for the API from unauthenticated access permissions to authenticated access permissions.

10. The API call filtering system of claim 1 , wherein the incoming API call request received from the one or more endpoint application includes requests to authenticate the one or more endpoint application with respect to a secure account maintained at, or for, the API service.

11. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, wherein the computer system is an application programming interface (API) wall, cause the computer system to at least:
identify, at an API wall, a plurality of API call requests for a web service, the plurality of API call requests transmitted from endpoints to a server, wherein the server is a component of an enterprise network;
identify, at the API wall, a plurality of API call responses transmitted from the server;
collect business intelligence related to the plurality of API call requests and the plurality of API call responses, the business intelligence including statistics and properties of the endpoint;
compile a report, the report including statistics, analysis, and/or recommendations related to the plurality of API call requests, wherein the report includes authentication method information of the plurality of API call requests;
create, via the API wall, a dashboard including information related to API use across the enterprise network; and
provide, via the API wall, control mechanisms for modifying access to an API, limiting access to the API, creating access control lists (ACLs), and enforcing ACLs, wherein control mechanisms operate in response to security team inputs following output of the report, wherein modifying access comprises modifying an authentication method of at least one incoming API call request that, for at least some incoming API call requests, creates a requirement that the at least one incoming API call request satisfy an authentication test that the at least one incoming API call request would not have otherwise had to satisfy.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to create, via the API wall, a list of APIs that are called across an enterprise network.

13. The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to record traffic over the network from an endpoint to a web server, the web server configured to provide web services in response to an API call request from one or more of the endpoints.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the computer system to record traffic over the network further include instructions that cause the computer system to:
systematically browse web assets to identify traffic that originates from browser-driven website interaction; and
remove identified browser-driven website interaction traffic from the traffic recorded over the network in order to improve identification of API calls.

15. The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to collect properties determined at the API wall, the properties including measured frequency, measured velocity, time of day, geo-location, or response times.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions that cause the computer system to collect properties further include instructions that cause the computer system to determine if APIs are chained together with an API call request to one leading to API call requests to another.

17. The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further comprise

Assignees

• Shape Security Inc

Inventors

• Call Justin D
• Peacock Timothy D

Classifications

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• H04L43/062

  related to network traffic · CPC title