Granted Patent B2

US 12,341,821 · App. 17/946,097 · Granted Jun 24, 2025

Inventors: Thomas Dürr (Magstadt, DE); Martin Smolny (Boeblingen, DE); Michael Beck (Bad Teinach-Zavelstein, DE); Daniel Pittner (Esslingen am Neckar, DE)

Assignee: International Business Machines Corporation

H04L63/20G06Q30/018

Abstract

Claims (75)

1. A method, in a data processing system, for dispatching requests to service instances based on data storage boundaries, the method comprising:

receiving, from a first computing device via a first communication connection with the data processing system, a first request to access data associated with an identity specified in the first request;

dispatching the first request to a first service instance associated with a first data storage boundary of a plurality of data storage boundaries, wherein each data storage boundary is defined by a regulation or policy restricting data storage of one or more specific types of data to computing devices within a specified physical, or network topological, region;

receiving a feedback response from the first service instance in response to the first service instance determining that the first service instance does not have access to the data due to the data being of a type that is associated with a second data storage boundary different from the first data storage boundary, wherein the feedback response specifies a target location associated with the second data storage boundary;

in response to receiving the feedback response, automatically generating a dynamic dispatch rule specifying the identity and the target location and storing the dynamic dispatch rule in a dynamic dispatch rule database; and

processing a subsequent second request, associated with a different communication connection with the data processing system by a same or different computing device as the first computing device, specifying the identity at least by performing a lookup operation in the dynamic dispatch rule database for a matching dynamic dispatch rule corresponding to the specified identity and executing the matching dynamic dispatch rule to dispatch the subsequent request directly to a second service instance associated with the target location,

wherein processing the subsequent second request comprises:

performing a lookup in the dynamic dispatch rule database for the identity specified in the second request;

in response to finding a matching dynamic dispatch rule in the dynamic dispatch rule database for the identity, executing the matching dynamic dispatch rule to set a data storage boundary, in the plurality of data storage boundaries, that corresponds to the identity, to be a second data storage boundary;

transmitting the second request to the second service instance, wherein the second service instance is associated with the second data storage boundary;

receiving data requested by the second request based on a processing of the second request at the second service instance to obtain the data requested by the second request from the target location; and

transmitting a response, based on the received data from the target location, to a requesting computing device that sent the second request.

2. The method of claim 1 , wherein dispatching the first request to a first service instance comprises:

performing a lookup in the dynamic dispatch rule database for the identity specified in the first request; and

in response to failing to find a matching entry in the dynamic dispatch rule database for the identity, executing a load balancing operation to dispatch the first request to a next available service instance as the first service instance.

3. The method of claim 1 , wherein receiving the feedback response from the first service instance comprises:

requesting, by the first service instance, data corresponding to the identity in the request from a backend service instance database;

in response to not finding the data corresponding to the identity in the backend service instance database, sending, by the first service instance, a target location request that requests the target location of the data to a global account management service;

receiving, by the first service instance, the target location of the data from the global account management service; and

sending, by a feedback agent of the first service instance, the feedback response specifying the target location to the data processing system.

4. The method of claim 3 , wherein the feedback response is sent asynchronously, with respect to processing the first request, by the feedback agent to the data processing system, and wherein automatically generating a dynamic dispatch rule is performed asynchronously with respect to processing the first request.

5. The method of claim 1 , further comprising:

dispatching, by the first service instance to the second service instance, the first request;

receiving, by the first service instance, from the second service instance, the data for which access is requested in the first request;

generating a response to the first request based on the received data; and

sending the response to a requesting computing device that sent the first request.

6. The method of claim 1 , wherein the plurality of data storage boundaries are at least one of geographical, geopolitical, or organizational data storage boundaries that specify data associated with a geographical entity, geopolitical entity, or organization entity cannot be stored outside a corresponding data storage boundary.

7. The method of claim 1 , wherein the identity specified in the first request is an APIKey corresponding to the data for which access is requested by the first request, and wherein the data comprises personally identifiable data of one or more accounts in a cloud computing environment, wherein the personally identifiable data of the one or more accounts is restricted to storage within corresponding data storage boundaries in the plurality of data storage boundaries.

8. The method of claim 1 , wherein the data processing system is a global gateway computing system, of a cloud computing environment, operating in conjunction with a plurality of different service instances across a plurality of data storage boundaries.

9. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to:

receive, from a first computing device via a first communication connections with the data processing system, a first request to access data associated with an identity specified in the first request;

dispatch the first request to a first service instance associated with a first data storage boundary of a plurality of data storage boundaries, wherein each data storage boundary is defined by a regulation or policy restricting data storage of one or more specific types of data to computing devices within a specified physical, or network topological, region;

receive a feedback response from the first service instance in response to the first service instance determining that the first service instance does not have access to the data due to the data being of a type that is associated with a second data storage boundary different from the first data storage boundary, wherein the feedback response specifies a target location associated with the second data storage boundary;

in response to receiving the feedback response, automatically generate a dynamic dispatch rule specifying the identity and the target location and storing the dynamic dispatch rule in a dynamic dispatch rule database; and

process a subsequent second request, associated with a second communication connection with the data processing system by a same or different computing device as a first computing device, specifying the identity at least by performing a lookup operation in the dynamic dispatch rule database for a matching dynamic dispatch rule corresponding to the specified identity and executing the matching dynamic dispatch rule to dispatch the subsequent request directly to a second service instance associated with the target location,

wherein processing the subsequent second request comprises:

performing a lookup in the dynamic dispatch rule database for the identity specified in the second request;

in response to finding a matching dynamic dispatch rule in the dynamic dispatch rule database for the identity, executing the matching dynamic dispatch rule to set a data storage boundary, in the plurality of data storage boundaries, that corresponds to the identity, to be a second data storage boundary;

transmitting the second request to the second service instance, wherein the second service instance is associated with the second data storage boundary;

receiving data requested by the second request based on a processing of the second request at the second service instance to obtain the data requested by the second request from the target location; and

transmitting a response, based on the received data from the target location, to a requesting computing device that sent the second request.

10. The computer program product of claim 9 , wherein dispatching the first request to a first service instance comprises:

performing a lookup in the dynamic dispatch rule database for the identity specified in the first request; and

in response to failing to find a matching entry in the dynamic dispatch rule database for the identity, executing a load balancing operation to dispatch the first request to a next available service instance as the first service instance.

11. The computer program product of claim 9 , wherein receiving the feedback response from the first service instance comprises:

requesting, by the first service instance, data corresponding to the identity in the request from a backend service instance database;

in response to not finding the data corresponding to the identity in the backend service instance database, sending, by the first service instance, a target location request that requests the target location of the data to a global account management service;

receiving, by the first service instance, the target location of the data from the global account management service; and

sending, by a feedback agent of the first service instance, the feedback response specifying the target location to the data processing system.

12. The computer program product of claim 11 , wherein the feedback response is sent asynchronously, with respect to processing the first request, by the feedback agent to the data processing system, and wherein automatically generating a dynamic dispatch rule is performed asynchronously with respect to processing the first request.

13. The computer program product of claim 9 , further comprising:

dispatching, by the first service instance to the second service instance, the first request;

receiving, by the first service instance, from the second service instance, the data for which access is requested in the first request;

generating a response to the first request based on the received data; and

sending the response to a requesting computing device that sent the first request.

14. The computer program product of claim 9 , wherein the plurality of data storage boundaries are at least one of geographical, geopolitical, or organizational data storage boundaries that specify data associated with a geographical entity, geopolitical entity, or organization entity cannot be stored outside a corresponding data storage boundary.

15. The computer program product of claim 9 , wherein the identity specified in the first request is an APIKey corresponding to the data for which access is requested by the first request, and wherein the data comprises personally identifiable data of one or more accounts in a cloud computing environment, wherein the personally identifiable data of the one or more accounts is restricted to storage within corresponding data storage boundaries in the plurality of data storage boundaries.

16. The computer program product of claim 9 , wherein the data processing system is a global gateway computing system, of a cloud computing environment, operating in conjunction with a plurality of different service instances across a plurality of data storage boundaries.

17. An apparatus comprising:

at least one processor; and

at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:

receive, from a first computing device via a first communication connection with a data processing system, a first request to access data associated with an identity specified in the first request;

dispatch the first request to a first service instance associated with a first data storage boundary of a plurality of data storage boundaries, wherein each data storage boundary is defined by a regulation or policy restricting data storage of one or more specific types of data to computing devices within a specified physical, or network topological, region;

receive a feedback response from the first service instance in response to the first service instance determining that the first service instance does not have access to the data due to the data being of a type that is associated with a second data storage boundary different from the first data storage boundary, wherein the feedback response specifies a target location associated with the second data storage boundary;

in response to receiving the feedback response, automatically generate a dynamic dispatch rule specifying the identity and the target location and storing the dynamic dispatch rule in a dynamic dispatch rule database; and

process a subsequent second request, associated with a second communication connection with the data processing system by a same or different computing device as the first computing device, specifying the identity at least by performing a lookup operation in the dynamic dispatch rule database for a matching dynamic dispatch rule corresponding to the specified identity and executing the matching dynamic dispatch rule to dispatch the subsequent request directly to a second service instance associated with the target location,

wherein processing the subsequent second request comprises:

performing a lookup in the dynamic dispatch rule database for the identity specified in the second request;

in response to finding a matching dynamic dispatch rule in the dynamic dispatch rule database for the identity, executing the matching dynamic dispatch rule to set a data storage boundary, in the plurality of data storage boundaries, that corresponds to the identity, to be a second data storage boundary;

transmitting the second request to the second service instance, wherein the second service instance is associated with the second data storage boundary;

receiving data requested by the second request based on a processing of the second request at the second service instance to obtain the data requested by the second request from the target location; and

transmitting a response, based on the received data from the target location, to a requesting computing device that sent the second.

18. The method of claim 1 , wherein processing the subsequent second request further comprises:

in response to receiving a response from the second service instance indicating that the data associated with the identity specified in the first request has moved to a third location, updating the matching dynamic dispatch rule to specify the third location as an updated target location; and

redirecting the second request to the third location.

Assignments (1)

Continuity (1)

References Cited (34)