Pre-signed Proxy Redirect for Multi-Cloud Object Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional proxy service implementations incur significant performance penalties due to the need for two upload/download operations for every user request, as users interact primarily with their designated cloud storage provider through the proxy service, leading to inefficiencies in enterprise networks with multiple users and providers.
Innovation Solution
A method and system that provide a pre-signed proxy redirect, allowing users to directly access objects from cloud storage providers by generating and transmitting application protocols that redirect to pre-signed web addresses, thereby bypassing the proxy service for object storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a conventional proxy service is used to manage object storage across multiple cloud providers, then users can access objects through a unified interface, but the proxy service must perform two upload/download operations for every user request, resulting in significant performance penalties and increased network consumption
Solution Approach 1:
The system performs preliminary actions by generating pre-signed URLs that contain pre-authenticated access credentials before the user actually retrieves objects. These pre-signed URLs are generated in advance and cached, so when users need to access objects, they can do so directly through the pre-authenticated URLs without going through the proxy service, thus eliminating the two-upload/download operations while maintaining unified multi-cloud access
2Adaptability or versatility
If a conventional proxy service is used to manage object storage across multiple cloud providers, then users can access objects through a unified interface, but the proxy service must perform two upload/download operations for every user request, resulting in increased network consumption
Solution Approach 1:
The system generates pre-signed URLs in advance that embed authentication credentials and access permissions. These pre-signed URLs allow users to access objects directly from cloud storage providers without routing through the proxy service. By caching these pre-generated URLs, the system eliminates repeated upload/download operations through the proxy, significantly reducing network consumption while maintaining unified multi-cloud access capability
Solution Approach 2:
The invention extracts the authentication and access control functionality from the proxy service and embeds it directly into the pre-signed URLs. This extraction allows object access operations to bypass the proxy service entirely, removing the proxy as an intermediate node in the data transfer path and thereby reducing network consumption while preserving the unified interface benefit
3Productivity
If pre-signed redirect URLs are generated and cached, then direct object access is enabled without proxy intervention, but additional steps for generating and managing pre-signed URLs are required
Solution Approach 1:
The system implements self-service by enabling the automated generation, validation, and caching of pre-signed URLs through configuration files that users can define themselves. The proxy service automatically manages the lifecycle of these URLs including generation from configuration, validation of access requests, and caching mechanisms. This automation reduces manual configuration complexity while enabling direct object access that improves retrieval speed
Data Source
AI summary
A method for providing a proxy redirect to facilitate a storage and a retrieval of an object is disclosed. The method includes receiving a mapping of a user to a logical container that stores the object and to a storage provider that stores the logical container; receiving a key corresponding to the logical container and associated with the user; storing the mapping and the key in a database; generating, for the user, an application protocol that redirects to a pre-signed web address based on the stored mapping and the stored key; and transmitting, via a communication interface, the application protocol to the one user. The method further includes the user using the application protocol to directly access the storage provider and retrieve the object.