Java IoT Authors: Yeshim Deniz, Pat Romanski, Carmen Gonzalez, Jim Kaskade, Elizabeth White

Blog Feed Post

Instant API Management with Intel and Amazon

Instant API Management with Intel and Amazon

Instant API Management with Intel and Amazon

Did you know you can get started with Intel Expressway API Manager on AWS Marketplace today with only a few clicks? You can have instant API Management and enhanced EC2 security for applications and services exposed from public or hybrid cloud environments.

The offering is available from Amazon to anyone with a valid Amazon account. If you haven’t tried Amazon’s AWS marketplace, you can have an instance of the gateway up and running in a few minutes.

Are you looking to mobile enable an Enterprise application need to expose an API? Are you looking to try a flexible DevOps model for cloud bursting? Are you looking to provide a centralized API governance, security and throttling layer for Enterprise applications? If so, Expressway can help.

Here are four things you can do today with Intel Expressway on Amazon AWS Marketplace:

1. Publish a Mobile Ready API

Here is the scenario – you have data you want to make available to an HTML5 mobile application, but it’s split up among different application services in your Enterprise environment. Each service sends its reply with different data formats, some are XML, some are JSON, and some are text, and becasue these services weren’t designed with mobile in mind, they send too much information. What you want is a mashed-up, filtered subset. Worse, authentication for this data is also based on different types of credentials, such as a username/password or Kerberos ticket.

You’ve considered custom development work to bring together these services to expose an API, and you’ve also considered trying to parse, transform and filter the data on the client, but you feel the app experience would be negatively impacted due to client performance. Each alternative is wrought with development costs. What to do? Expose the API through a gateway.


Expressway API Manager can easily expose a mobile ready API from existing middleware and services

To test it out, you can load sample responses from your services directly into Expressway, and design a proof-of-concept in the cloud. When you are read to move to production you can either migrate your applications to the public cloud or stand-up a gateway in your internal network. To facilitate testing, you can also rely on mock-up services such as mocky.

2. API Data Protection & Compliance

Here is the scenario: Suppose you are using Amazon’s DynamoDB, a standard SQL database or another cloud-hosted Big Data solution. Your application collects personally identifiable information (PII) or PCI information for CRM or lead management and communicates using APIs.

You you want to ensure this data remains protected in the cloud, and more importantly, when it is made available to API clients, such as a smartphone or partner web service, the caller should only be able to view protected information if they have the proper authorization.

You need a way to enforce fine-grained compliance on API content. Worse, you want to enforce security in the same way, no matter what persistence technology you may switch to in the future. It’s SQL today, but it could be NoSQL tomorrow. What to do? Protect API content using a gateway.

API Management and Compliance with DynamoDB

API Management and Compliance with DynamoDB

In the previous example sensitive information such as a social security number, driver’s license, credit card, or bank account information can  be encrypted and protected before it is stored in the cloud. Data protection is enabled by a pii protection policy in Expressway and inserted directly to the persistence layer using RESTful APIs or through the use of the Expressway Java extensibility framework.

Protection here means format preserving encryption which preserves the data type and output length of the original plain-text, minimizing application changes compared to traditional symmetric encryption which operates on padded octets.

Further, data can only be decrypted by the gateway layer and access is enforced using strong identity management, OAuth 2, X.509 certificates or 2-factor authentication, adding an additional layer of compliance to API content.

3. Extend Your ‘API Network’

Here is the scenario: You want to enforce API governance but don’t want to migrate all of your back-end applications to the public cloud. Or perhaps you want to migrate some back-end services, but not all. On top of this, you have to consider an efficient network architecture, which means network latency is an important factor. What to do?

Given Amazon’s ability to handle multi-homed EC2 instances as well as Amazon’s VPC feature, you can create a hybrid API architecture with improved network latency and improved time to market.

API Management-Amazon-VPC

In the previous diagram, the network design allows the Enterprise to immediately expose APIs with minimal application changes. The gateway is deployed in a VPC in a multi-homed configuration with a public IP address and an IP address in a private subnet connected through a hardware VPN. This means services can stay where they are.

The gateway acts as the enforcement and API exposure point (see the first use case), receiving API requests from mobile devices on the Internet that eventually route to services in the Enterprise Datacenter or in the Amazon Virtual Private Cloud (VPC).

This network architecture also provides improved client latency compared to a pure on-premise approach as additional network hops can be skipped compared to a case where the Enterprise has to expose an APIs through its DMZ.

4. Design an API Governance Layer

Here is the scenario: Suppose you have exposed a few APIs to support your mobile and partner strategy with some success. Perhaps you’ve exposed APIs directly by the smart use of open source frameworks such as Jersey, Microsoft, Node.js, RESTlet, or Ruby on Rails.

You’ve been successful with a handful of developers and have implemented security, throttling, authentication and API design with careful and deliberate project management. Now you need to scale from a handful of APIs to hundreds or even more. You need a consistent way to expose APIs with policies, not code. You need screaming performance and scale with built-in perimeter defense and application level denial of service protection.

Also, you need to ensure your APIs are available to the right developers at the right time to drive value throughout your organization. You also need API sharing. What to do? Design a scalable API Governance layer.

API Governance Layer

Here you can use the gateway and the examples described above as a design pattern for an API governance layer, which can be scaled in the Amazon cloud or in a hybrid architecture.

This means the API definitions, associated policies and the sharing of API definitions to developers is all handled at the gateway layer. You design your API interfaces independent of how the APIs are implemented. Today it could be a Microsoft .NET web service and tomorrow it could be Node.js. All of the security policies, API plans, authentication, data mediation and API sharing options are managed at the gateway. The gateway layer becomes the API consolidation point.

Intel provides both on-premise, partner and SaaS based API sharing options depending on your level of scale, control and security. The API sharing layer is available as an add-on component to the gateway, please contact us for more information.

How to Get Started

Want to see more? We’ve got a technical tutorial video here, the AWS API Tech Tutorial that runs through the sample application provided with the gateway and the offering is available from the link Intel Expressway API Manager link on AWS Marketplace.

It should be noted that some of the features above are enabled through the use of our visual policy editor, which is available at no cost to marketplace subscribers while others use the built-in policy editor available on the web interface.

Features that require the editor include Websockets, OAuth enablement, advanced protocol and data format mediation, database support & enterprise identity management. Please contact support to request the policy editor which is available at no extra charge to valid subscribers.


The post Instant API Management with Intel and Amazon appeared first on Application Security.

Read the original blog entry...

More Stories By Application Security

This blog references our expert posts on application and web services security.

@ThingsExpo Stories
Established in 1998, Calsoft is a leading software product engineering Services Company specializing in Storage, Networking, Virtualization and Cloud business verticals. Calsoft provides End-to-End Product Development, Quality Assurance Sustenance, Solution Engineering and Professional Services expertise to assist customers in achieving their product development and business goals. The company's deep domain knowledge of Storage, Virtualization, Networking and Cloud verticals helps in delivering ...
24Notion is full-service global creative digital marketing, technology and lifestyle agency that combines strategic ideas with customized tactical execution. With a broad understand of the art of traditional marketing, new media, communications and social influence, 24Notion uniquely understands how to connect your brand strategy with the right consumer. 24Notion ranked #12 on Corporate Social Responsibility - Book of List.
SYS-CON Events announced today that SoftNet Solutions will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. SoftNet Solutions specializes in Enterprise Solutions for Hadoop and Big Data. It offers customers the most open, robust, and value-conscious portfolio of solutions, services, and tools for the shortest route to success with Big Data. The unique differentiator is the ability to architect and...
In past @ThingsExpo presentations, Joseph di Paolantonio has explored how various Internet of Things (IoT) and data management and analytics (DMA) solution spaces will come together as sensor analytics ecosystems. This year, in his session at @ThingsExpo, Joseph di Paolantonio from DataArchon, will be adding the numerous Transportation areas, from autonomous vehicles to “Uber for containers.” While IoT data in any one area of Transportation will have a huge impact in that area, combining senso...
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
Cognitive Computing is becoming the foundation for a new generation of solutions that have the potential to transform business. Unlike traditional approaches to building solutions, a cognitive computing approach allows the data to help determine the way applications are designed. This contrasts with conventional software development that begins with defining logic based on the current way a business operates. In her session at 18th Cloud Expo, Judith S. Hurwitz, President and CEO of Hurwitz & ...
@ThingsExpo has been named the Top 5 Most Influential M2M Brand by Onalytica in the ‘Machine to Machine: Top 100 Influencers and Brands.' Onalytica analyzed the online debate on M2M by looking at over 85,000 tweets to provide the most influential individuals and brands that drive the discussion. According to Onalytica the "analysis showed a very engaged community with a lot of interactive tweets. The M2M discussion seems to be more fragmented and driven by some of the major brands present in the...
In the next five to ten years, millions, if not billions of things will become smarter. This smartness goes beyond connected things in our homes like the fridge, thermostat and fancy lighting, and into heavily regulated industries including aerospace, pharmaceutical/medical devices and energy. “Smartness” will embed itself within individual products that are part of our daily lives. We will engage with smart products - learning from them, informing them, and communicating with them. Smart produc...
As ridesharing competitors and enhanced services increase, notable changes are occurring in the transportation model. Despite the cost-effective means and flexibility of ridesharing, both drivers and users will need to be aware of the connected environment and how it will impact the ridesharing experience. In his session at @ThingsExpo, Timothy Evavold, Executive Director Automotive at Covisint, will discuss key challenges and solutions to powering a ride sharing and/or multimodal model in the a...
In his keynote at 19th Cloud Expo, Sheng Liang, co-founder and CEO of Rancher Labs, will discuss the technological advances and new business opportunities created by the rapid adoption of containers. With the success of Amazon Web Services (AWS) and various open source technologies used to build private clouds, cloud computing has become an essential component of IT strategy. However, users continue to face challenges in implementing clouds, as older technologies evolve and newer ones like Docke...
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
SYS-CON Events announced today that Embotics, the cloud automation company, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Embotics is the cloud automation company for IT organizations and service providers that need to improve provisioning or enable self-service capabilities. With a relentless focus on delivering a premier user experience and unmatched customer support, Embotics is the fas...
SYS-CON Events announced today that Coalfire will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Coalfire is the trusted leader in cybersecurity risk management and compliance services. Coalfire integrates advisory and technical assessments and recommendations to the corporate directors, executives, boards, and IT organizations for global brands and organizations in the technology, cloud, health...
Cloud based infrastructure deployment is becoming more and more appealing to customers, from Fortune 500 companies to SMEs due to its pay-as-you-go model. Enterprise storage vendors are able to reach out to these customers by integrating in cloud based deployments; this needs adaptability and interoperability of the products confirming to cloud standards such as OpenStack, CloudStack, or Azure. As compared to off the shelf commodity storage, enterprise storages by its reliability, high-availabil...
The IoT industry is now at a crossroads, between the fast-paced innovation of technologies and the pending mass adoption by global enterprises. The complexity of combining rapidly evolving technologies and the need to establish practices for market acceleration pose a strong challenge to global enterprises as well as IoT vendors. In his session at @ThingsExpo, Clark Smith, senior product manager for Numerex, will discuss how Numerex, as an experienced, established IoT provider, has embraced a ...
SYS-CON Events announced today that MathFreeOn will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. MathFreeOn is Software as a Service (SaaS) used in Engineering and Math education. Write scripts and solve math problems online. MathFreeOn provides online courses for beginners or amateurs who have difficulties in writing scripts. In accordance with various mathematical topics, there are more tha...
@ThingsExpo has been named the Top 5 Most Influential Internet of Things Brand by Onalytica in the ‘The Internet of Things Landscape 2015: Top 100 Individuals and Brands.' Onalytica analyzed Twitter conversations around the #IoT debate to uncover the most influential brands and individuals driving the conversation. Onalytica captured data from 56,224 users. The PageRank based methodology they use to extract influencers on a particular topic (tweets mentioning #InternetofThings or #IoT in this ...
Complete Internet of Things (IoT) embedded device security is not just about the device but involves the entire product’s identity, data and control integrity, and services traversing the cloud. A device can no longer be looked at as an island; it is a part of a system. In fact, given the cross-domain interactions enabled by IoT it could be a part of many systems. Also, depending on where the device is deployed, for example, in the office building versus a factory floor or oil field, security ha...
SYS-CON Events announced today that Transparent Cloud Computing (T-Cloud) Consortium will exhibit at the 19th International Cloud Expo®, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The Transparent Cloud Computing Consortium (T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data proces...
Donna Yasay, President of HomeGrid Forum, today discussed with a panel of technology peers how certification programs are at the forefront of interoperability, and the answer for vendors looking to keep up with today's growing industry for smart home innovation. "To ensure multi-vendor interoperability, accredited industry certification programs should be used for every product to provide credibility and quality assurance for retail and carrier based customers looking to add ever increasing num...