# US 11,310,204 B2 · Centralized access to data repository from a multi-cloud computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,204 B2 - Document ID: US11310204B2 - Status: Granted - Kind: B2 - Application number: 16/189,030 - Filed: 2018-11-13 - Published: 2020-05-14 - Granted: 2022-04-19 - Earliest claimed: 2018-11-13 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Wolf Liebherr - Web page: https://patentgrep.com/patent/US11310204B2 ## CPC - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/0281: {Proxies} - H04L 63/126: {the source of the received data} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L 67/563: Data redirection of data network streams - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04L 67/5683: Storage of data provided by user terminals, i.e. reverse caching - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for accessing a web-based repository service from a cloud platform is provided. The method may include receiving, at a gateway controller, a first request from an endpoint to access the web-based repository service. Upon successfully verifying the first request, a redirect request to a reverse proxy at the gateway controller may be returned to the endpoint. The redirect request may include a cryptographic signature and the first request. The reverse proxy may respond to the redirect request from the endpoint by accessing, on behalf of the endpoint, the web-based repository service to store and/or retrieve data. The web-based repository service may be accessed by sending, to the web-based repository service, an encrypted second request corresponding to the first request. Related systems and articles of manufacture, including computer program products, are also provided. ## Claims ### Claim 1 A system, comprising: at least one data processor; and at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising: intercepting, at a gateway controller, a first request from an endpoint to access a web-based repository service accessible through a public network, the gateway controller and the endpoint being within a private network, the gateway controller configured to prevent unencrypted requests to access the web-based repository from exiting the private network and/or entering the public network by at least intercepting the unencrypted requests, and the endpoint being associated with a first cloud platform; verifying, by the gateway controller, the first request to determine, based at least on an header of the first request and/or an Internet Protocol (IP) address of the endpoint, whether the endpoint is authorized to access the web-based repository service to store and/or retrieve a data associated with the first request; upon the gateway controller successfully verifying the first request, sending, by the gateway controller and to the endpoint, a redirect request to a reverse proxy at the gateway controller, the redirect request including the first request, and the redirect request configured to be forwarded by the endpoint to the reverse proxy; responding, by the reverse proxy at the gateway controller, to the redirect request from the endpoint by at least accessing, on behalf of the endpoint, the web-based repository service to store and/or retrieve the data associated with the first request, the web-based repository service being accessed by the reverse proxy translating the first request from an unencrypted request to an encrypted second request, and sending, to the web-based repository service via the public network, the encrypted second request corresponding to the first request; storing, in a cache associated with the gateway controller, at least a portion of data retrieved from the web-based repository service; and intercepting, at the gateway controller, a third request from the endpoint to access the web-based repository service prior to the third request exiting the private network and/or entering the public network in order to confine the third request within the private network, the gateway controller responding to the third request by at least accessing the cache prior to accessing the web-based repository service, and the gateway controller using at least the portion of the data stored in the cache to respond to the third request. ### Claim 2 (depends on 1) The system of claim 1, wherein the redirect request further includes a cryptographic signature that the gateway controller generates for the endpoint, in response to successfully verifying the first request from the endpoint. ### Claim 3 (depends on 2) The system of claim 2, wherein the cryptographic signature comprises a hashed message authentication code. ### Claim 4 (depends on 1) The system of claim 1, wherein the first request comprises a Hypertext Transfer Protocol (HTTP) request, and wherein the encrypted second request comprises a Hypertext Transfer Protocol Secure (HTTPS) request. ### Claim 5 (depends on 4) The system of claim 4, wherein the reverse proxy is configured to translate the Hypertext Transfer Protocol request into the Hypertext Transfer Protocol Secure request. ### Claim 6 (depends on 1) The system of claim 1, wherein the web-based repository service provides object-based storage, block-based storage, and/or file-based storage. ### Claim 7 (depends on 1) The system of claim 1, wherein the first cloud platform and a second cloud platform form a multi-cloud computing environment, and wherein another instance of the gateway controller is deployed at the second cloud platform to enable another endpoint at the second cloud platform to access the web-based repository service. ### Claim 8 (depends on 7) The system of claim 7, wherein the multi-cloud computing environment comprises a hybrid cloud computing environment in which the first cloud platform comprises a private cloud platform and the second cloud platform comprises a public cloud platform. ### Claim 9 A computer-implemented method, comprising: intercepting, at a gateway controller, a first request from an endpoint to access a web-based repository service accessible through a public network, the gateway controller and the endpoint being within a private network , the gateway controller configured to prevent unencrypted requests to access the web-based repository from exiting the private network and/or entering the public network by at least intercepting the unencrypted requests, and the endpoint being associated with a first cloud platform; verifying, by the gateway controller, the first request to determine, based at least on an header of the first request and/or an Internet Protocol (IP) address of the endpoint, whether the endpoint is authorized to access the web-based repository service to store and/or retrieve a data associated with the first request; upon the gateway controller successfully verifying the first request, sending, by the gateway controller and to the endpoint, a redirect request to a reverse proxy at the gateway controller, the redirect request including the first request, and the redirect request configured to be forwarded by the endpoint to the reverse proxy; responding, by the reverse proxy at the gateway controller, to the redirect request from the endpoint by at least accessing, on behalf of the endpoint, the web-based repository service to store and/or retrieve the data associated with the first request, the web-based repository service being accessed by the reverse proxy translating the first request from an unencrypted request to an encrypted second request, and sending, to the web-based repository service via the public network, the encrypted second request corresponding to the first request; storing, in a cache associated with the gateway controller, at least a portion of data retrieved from the web-based repository service; and intercepting, at the gateway controller, a third request from the endpoint to access the web-based repository service prior to the third request exiting the private network and/or entering the public network in order to confine the third request within the private network, the gateway controller responding to the third request by at least accessing the cache prior to accessing the web-based repository service, and the gateway controller using at least the portion of the data stored in the cache to respond to the third request. ### Claim 10 (depends on 9) The method of claim 9, wherein the redirect request further includes a cryptographic signature that the gateway controller generates for the endpoint, in response to successfully verifying the first request from the endpoint. ### Claim 11 (depends on 10) The method of claim 10, wherein the cryptographic signature comprises a hashed message authentication code. ### Claim 12 (depends on 9) The method of claim 9, wherein the first request comprises a Hypertext Transfer Protocol (HTTP) request, and wherein the encrypted second request comprises a Hypertext Transfer Protocol Secure (HTTPS) request. ### Claim 13 (depends on 12) The method of claim 12, wherein the reverse proxy is configured to translate the Hypertext Transfer Protocol request into the Hypertext Transfer Protocol Secure request. ### Claim 14 (depends on 9) The method of claim 9, wherein the web-based repository service provides object-based storage, block-based storage, and/or file-based storage. ### Claim 15 (depends on 9) The method of claim 9, wherein the first cloud platform and a second cloud platform form a multi-cloud computing environment, and wherein another instance of the gateway controller is deployed at the second cloud platform to enable another endpoint at the second cloud platform to access the web-based repository service. ### Claim 16 A non-transitory computer readable medium storing instructions, which when executed by at least one data processor, result in operations comprising: intercepting, at a gateway controller, a first request from an endpoint to access a web-based repository service accessible through a public network, the gateway controller and the endpoint being within a private network-, the gateway controller configured to prevent unencrypted requests to access the web-based repository from exiting the private network and/or entering cntcr the public network by at least intercepting the unencrypted requests, and the endpoint being associated with a first cloud platform; verifying, by the gateway controller, the first request to determine, based at least on an header of the first request and/or an Internet Protocol (IP) address of the endpoint, whether the endpoint is authorized to access the web-based repository service to store and/or retrieve a data associated with the first request; upon the gateway controller successfully verifying the first request, sending, by the gateway controller and to the endpoint, a redirect request to a reverse proxy at the gateway controller, the redirect request including the first request, and the redirect request configured to be forwarded by the endpoint to the reverse proxy; responding, by the reverse proxy at the gateway controller, to the redirect request from the endpoint by at least accessing, on behalf of the endpoint, the web-based repository service to store and/or retrieve the data associated with the first request, the web-based repository service being accessed by the reverse proxy translating the first request from an unencrypted request to an encrypted second request, and sending, to the web-based repository service via the public network, the encrypted second request corresponding to the first request; storing, in a cache associated with the gateway controller, at least a portion of data retrieved from the web-based repository service; and intercepting, at the gateway controller, a third request from the endpoint to access the web-based repository service prior to the third request exiting the private network and/or entering the public network in order to confine the third request within the private network, the gateway controller responding to the third request by at least accessing the cache prior to accessing the web-based repository service, and the gateway controller using at least the portion of the data stored in the cache to respond to the third request.