System and method for implementing data sovereignty safeguards in a distributed services network architecture
Embodiments of systems and methods for implementing data sovereignty safeguards in a distributed services network architecture are disclosed. Embodiments of a distributed services system may have a number of distributed nodes that each implements a set of services. When a user requests a service at a particular node of a distributed services system, the node is configured to determine if that node is not (or is) data sovereign for a region associated with the user. If the node is not data sovereign for the user's region, the user may be directed to a corresponding service at a node of the distributed service system that is data sovereign for the user's region.
1. A method, comprising:
receiving, at a node of a distributed service system, a request for a service from a user, the request received through an interface of the service provided by the node;
determining, at the node, whether data sovereignty enforcement should be implemented with respect to the request;
when it is determined that data sovereignty enforcement should be implemented with respect to the request, identifying whether the service provided by the node, a data store associated with the node, or the node, is data sovereign for a region associated with the user or the request;
when it is determined that the service provided by the node, a data store associated with the node, or the node, is not data sovereign for the region, determining a response based on a response configuration, wherein the response includes a location of an other node or an other service of the distributed service system that is data sovereign for the region, wherein the other node or other service implements the same service provided by the node; and
sending a communication to the other node or other server, or to the user, based on the determined response.
2. The method of claim 1 , wherein the response comprises implementing the request utilizing the other node or other service.
3. The method of claim 2 , wherein the communication comprises forwarding the request to the other node or the other service.
4. The method of claim 1 , wherein the determination that data sovereignty enforcement should be implemented with respect to the request is based on an enterprise account or user account maintained by the distributed service system.
5. The method of claim 4 , wherein the determination that the service provided by the node is not data sovereign for the region is based on the enterprise account or the user account maintained by the distributed service system.
6. The method of claim 5 , wherein the enterprise account or the user account are replicated across the node and the other node of the distributed service system.
7. A system, comprising:
a processor;
a non-transitory computer-readable medium comprising instructions for performing, at a node of a distributed service system:
receiving a request for a service from a user, the request received through an interface of the service provided by the node;
determining whether data sovereignty enforcement should be implemented with respect to the request;
when it is determined that data sovereignty enforcement should be implemented with respect to the request, identifying whether the service provided by the node, a data store associated with the node, or the node, is data sovereign for a region associated with the user or the request;
when it is determined that the service provided by the node, a data store associated with the node, or the node, is not data sovereign for the region, determining a response based on a response configuration, wherein the response includes a location of an other node or an other service of the distributed service system that is data sovereign for the region, wherein the other node or other service implements the same service provided by the node; and
sending a communication to the other node or other server, or to the user, based on the determined response.
8. The system of claim 7 , wherein the response comprises implementing the request utilizing the other node or other service.
9. The system of claim 8 , wherein the communication comprises forwarding the request to the other node or the other service.
10. The system of claim 7 , wherein the determination that data sovereignty enforcement should be implemented with respect to the request is based on an enterprise account or user account maintained by the distributed service system.
11. The system of claim 10 , wherein the determination that the service provided by the node is not data sovereign for the region is based on the enterprise account or the user account maintained by the distributed service system.
12. The system of claim 11 , wherein the enterprise account or the user account are replicated across the node and the other node of the distributed service system.
13. A non-transitory computer-readable medium storing instructions for:
receiving, at a node of a distributed service system, a request for a service from a user, the request received through an interface of the service provided by the node;
determining, at the node, whether data sovereignty enforcement should be implemented with respect to the request;
when it is determined that data sovereignty enforcement should be implemented with respect to the request, identifying whether the service provided by the node, a data store associated with the node, or the node, is data sovereign for a region associated with the user or the request;
when it is determined that the service provided by the node, a data store associated with the node, or the node, is not data sovereign for the region, determining a response based on a response configuration, wherein the response includes a location of an other node or an other service of the distributed service system that is data sovereign for the region, wherein the other node or other service implements the same service provided by the node; and
sending a communication to the other node or other server, or to the user, based on the determined response.
14. The non-transitory computer-readable medium of claim 13 , wherein the response comprises implementing the request utilizing the other node or other service.
15. The non-transitory computer-readable medium of claim 14 , wherein the communication comprises forwarding the request to the other node or the other service.
16. The non-transitory computer-readable medium of claim 13 , wherein the determination that data sovereignty enforcement should be implemented with respect to the request is based on an enterprise account or user account maintained by the distributed service system.
17. The non-transitory computer-readable medium of claim 16 , wherein the determination that the service provided by the node is not data sovereign for the region is based on the enterprise account or the user account maintained by the distributed service system.
18. The non-transitory computer-readable medium of claim 17 , wherein the enterprise account or the user account are replicated across the node and the other node of the distributed service system.