1. Browser based upload
    1. Management Server generates a unique pre-shared key (PSK1) on install and shares it with the SSVM agent. Nobody else has access to this key of course.
    2. Browser UI requests the upload form
    3. MS sends down a form with standard fields pre-populated such as the upload url, url expiry time, account uuid, content-type AND a signature calculated over these fields. The signature is calculated using the pre-shared key PSK1. The user can be asked for inputs such as the filename on her local computer, format, hypervisor and the MD5 sum of the file. The form action is to POST to the SSVM's public IP
    4. The browser POSTS the form as enctype="multipart/form-data" over HTTPS to the SSVM's public IP

    5. The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the form fields using the key PSK1. Once the fields are verified, it writes the  to the NFS storage to the location encoded in the URL. 

    6. Once the upload completes, the MD5 checksum is compared (if available from step c). If it matches, the agent informs the MS that the upload is successful and the template is registered. The MS returns the template identifier to the agent and the agent returns this id
  2. API-based upload
    1. Preshared key as before
    2. New API request "GetUploadParams" encoded the usual CloudStack API way using api keys. Request parameters include format, hypervisor, md5 sum
    3. MS response to (b) is a json document which includes an inner json structure detailing the form parameters as in (c) above. Outer json contains the upload URL and the pre-calculated signature (using PSK1) over the inner json.
    4. API user makes a PUT request over HTTPS to the URL obtained in (c)
    5. as before
    6. as before.