Data privacy awareness in workload provisioning

Abstract

Data privacy information related to specific data hosted by a first workload provisioned to a first location may be received. The first workload may be monitored to determine whether a second workload has accessed the first workload, determine whether the data privacy information indicates that the second workload is authorized to access the specific data hosted by the first workload, and determine whether the second workload has permission to access the specific data hosted by the first workload. If so, the first workload may be automatically provisioned to a second location that is permitted to provision the first workload based on the data privacy information.

Description

Background Art

[0001] The present invention relates to data processing and, more particularly, to provisioning workloads in a distributed computing environment.

[0002] Data privacy is an issue that concerns most information technology (IT) organizations. Some organizations have data privacy requirements due to contractual obligations. In addition, some countries enforce data privacy requirements based on laws and regulations. However, with the increasing globalization of IT assets, organizations are increasingly deploying data outside of their home territories. Managing such data securely presents certain challenges. Summary of the invention

[0003] According to the present invention, a method is now provided, comprising: receiving data privacy information related to specific data hosted by a first workload supplied to a first location; monitoring the first workload, wherein the monitoring of the first workload comprises: determining whether a second workload has accessed the first workload; in response to determining that the second workload has accessed the first workload, determining whether the second workload is indicated in the data privacy information as being authorized to access the specific data hosted by the first workload; in response to determining that the second workload is not indicated as being authorized to access the specific data hosted by the first workload, determining whether the second workload has the right to access the specific data hosted by the first workload; in response to determining that the second workload has the right to access the specific data hosted by the first workload, based on the data privacy information, using a processor to automatically supply the first workload to a second location to which the first workload is allowed to be supplied.

[0004] Viewed from another aspect, the present invention now provides a system comprising a processor programmed to initiate executable operations, the operations comprising: receiving data privacy information related to specific data hosted by a first workload supplied to a first location; monitoring the first workload, the monitoring of the first workload comprising: determining whether a second workload has accessed the first workload; in response to determining that the second workload has accessed the first workload, determining whether the second workload is indicated in the data privacy information as being authorized to access the specific data hosted by the first workload; in response to determining that the second workload is not indicated as being authorized to access the specific data hosted by the first workload, determining whether the second workload has the right to access the specific data hosted by the first workload; in response to determining that the second workload has the right to access the specific data hosted by the first workload, based on the data privacy information, using the processor to automatically supply the first workload to a second location to which the first workload is allowed to be supplied.

[0005] Viewed from another aspect, the present invention now provides a computer program product, comprising: a computer-readable storage medium having program code stored thereon, the program code being executable by a data processing system to initiate operations, including: receiving data privacy information related to specific data hosted by a first workload supplied to a first location; monitoring the first workload, the monitoring of the first workload comprising: determining whether a second workload has accessed the first workload; in response to determining that the second workload has accessed the first workload, determining whether the second workload is indicated in the data privacy information as being authorized to access the specific data hosted by the first workload; in response to determining that the second workload is not indicated as being authorized to access the specific data hosted by the first workload, determining whether the second workload has the right to access the specific data hosted by the first workload; in response to determining that the second workload has the right to access the specific data hosted by the first workload, based on the data privacy information, using a processor to automatically supply the first workload to a second location to which the first workload is allowed to be supplied. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 A cloud computing environment according to an embodiment of the present invention is depicted.

[0007] Figure 2 Abstract model layers according to an embodiment of the present invention are depicted.

[0008] Figure 3 is a block diagram illustrating an example architecture for a data processing system.

[0009] Figure 4 Depicts an example architecture for a security application.

[0010] Figure 5 is a flow chart illustrating an example of a method of providing data privacy awareness and protection.

[0011] Figure 6 is a flow chart illustrating an example of a method of monitoring a workload to determine if there are issues with the workload related to data privacy.

[0012] Figure 7 is a flow chart illustrating another example of a method of monitoring a workload to determine if there is an issue with the workload related to data privacy. DETAILED DESCRIPTION

[0013] The present invention relates to data processing and, more particularly, to provisioning workloads in a distributed computing environment.

[0014] Provisioning, orchestrator, and proxy services that manage workloads typically do not have the ability to identify when a workload is processing sensitive data that is not compliant with contracts, laws, or regulations. This can create high risk, including penalties and fines, to the organizations responsible for managing these workloads. The arrangement described in this article mitigates this risk.

[0015] According to the present invention, a workload hosting sensitive data can be provisioned to a location that not only has the capability to execute the workload, but also meets the requirements of the data privacy policy for hosting the data. In this regard, data privacy information associated with the data can be processed to identify a location that meets the requirements of the data privacy policy and has the capability to meet the workload specifications specified for the workload. Thus, the present invention provides a process for proactively provisioning workloads in a manner that complies with the data privacy policy.

[0016] For some reason, a user may move a workload from a current location to a new location. The user may not be fully aware of the data privacy policy. However, according to the present invention, the workload can also be monitored to determine whether the workload has issues with data privacy. In addition, workloads that were not initially provisioned using the process described herein can be monitored to determine whether there are issues with the workload related to data privacy. If any such issues exist, the workload can be automatically moved in real time to a location that allows the workload to be provisioned based on the data privacy policy. Such a location can satisfy the data privacy policy, thereby mitigating violations of the data privacy policy. In addition, notifications indicating the problem can be automatically generated and communicated to appropriate personnel, such as system or compliance administrators. With such information, the system or compliance administrator can take measures to mitigate the risk of the problem recurring.

[0017] Several definitions applicable throughout this document will now be presented.

[0018] As defined herein, the term "workload" refers to a volume of work (eg, processing and / or storage operations) performed by a device or system.

[0019] As defined herein, the term "provisioning a workload" refers to provisioning hardware and software resources for processing a workload and allocating the workload to those hardware and software resources.

[0020] As defined herein, the term "location" refers to a geographic location. A geographic location may be represented by a street address, a building name, a city name, a county name, a state or province name, a country name, a zip code, a Global Positioning System (GPS) coordinates, and / or may be represented in any other suitable manner.

[0021] As defined herein, the term "responsive to" means to be susceptible to responding or reacting to an action or event. Thus, if a second action is performed "in response to" a first action, there is a causal relationship between the occurrence of the first action and the occurrence of the second action, and the term "responsive to" represents this causal relationship.

[0022] As defined herein, the term "computer-readable storage medium" refers to a storage medium that contains or stores program code for use by or in connection with an instruction execution system, apparatus, or device. As defined herein, a "computer-readable storage medium" is not itself a transitory propagating signal.

[0023] As defined herein, the term "data processing system" refers to one or more hardware systems configured to process data, each hardware system including at least one processor programmed to initiate executable operations and memory.

[0024] As defined herein, the term "processor" means at least one hardware circuit (e.g., an integrated circuit) configured to execute instructions contained in a program code. Examples of processors include, but are not limited to, a central processing unit (CPU), an array processor, a vector processor, a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic array (PLA), an application specific integrated circuit (ASIC), a programmable logic circuit, and a controller.

[0025] As defined herein, the term "server" means a data processing system configured to share services with one or more other data processing systems.

[0026] As defined herein, the term "real time" refers to a level of processing responsiveness that a user or system perceives as sufficient to immediately make a particular process or determination, or which enables the processor to keep up with some external process.

[0027] As defined herein, the term "automatically" means without user intervention.

[0028] As defined herein, the term "user" refers to a person (ie, a human being).

[0029] First, it should be understood that although the present disclosure includes a detailed description about cloud computing, the implementation of the technical solutions recorded therein is not limited to a cloud computing environment, but can be implemented in combination with any other type of computing environment now known or later developed.

[0030] Cloud computing is a service delivery model for convenient, on-demand network access to a shared pool of configurable computing resources. Configurable computing resources are resources that can be quickly deployed and released with minimal management cost or interaction with the service provider, such as networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0031] Features include:

[0032] On-demand self-service: Cloud consumers can unilaterally and automatically deploy computing capabilities such as server time and network storage on demand without human interaction with the service provider.

[0033] Broad network access: Computing power can be accessed over the network through standard mechanisms that facilitate the use of the cloud through different types of thin-client or thick-client platforms (e.g., mobile phones, laptops, personal digital assistants (PDAs)).

[0034] Resource pool: The computing resources of the provider are grouped into resource pools and serve multiple consumers through a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated on demand. Generally, consumers cannot control or even know the exact location of the provided resources, but can specify the location (such as country, state or data center) at a higher level of abstraction, so it is location-independent.

[0035] Rapid elasticity: The ability to quickly and elastically (sometimes automatically) deploy computing power to scale up quickly, and quickly release it to scale down quickly. To consumers, the computing power available for deployment often appears to be unlimited, and any amount of computing power can be accessed at any time.

[0036] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0037] The service model is as follows:

[0038] Software as a Service (SaaS): The capability provided to consumers is to use the provider's applications running on a cloud infrastructure. Applications can be accessed from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems, storage, or even individual application capabilities.

[0039] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers on the cloud infrastructure, which are created using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0040] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, network, and other basic computing resources on which consumers can deploy and run arbitrary software including operating systems and applications. Consumers neither manage nor control the underlying cloud infrastructure, but have control over the operating system, storage, and applications they deploy, and may have limited control over selected network components (such as host firewalls).

[0041] The deployment model is as follows:

[0042] Private Cloud: Cloud infrastructure is run solely for an organization. The cloud infrastructure can be managed by the organization or a third party and can exist inside or outside the organization.

[0043] Community Cloud: A cloud infrastructure is shared by several organizations and supports a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). A community cloud can be managed by multiple organizations within the community or by a third party and can exist inside or outside the community.

[0044] Public cloud: Cloud infrastructure is provided to the public or to large industry groups and is owned by an organization that sells cloud services.

[0045] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community or public) in a deployment model that remain distinct entities but are bound together by standardized or proprietary technologies (such as cloud burst sharing for load balancing between clouds) that enable data and application portability.

[0046] The cloud computing environment is service-oriented, with characteristics centered on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0047] Reference now Figure 1 , in which an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud computing consumer can communicate, and the local computing device can be, for example, a personal digital assistant (PDA) or a mobile phone 54A, a desktop computer 54B, a laptop computer 54C and / or an automobile computer system 54N. The cloud computing nodes 10 can communicate with each other. The cloud computing nodes 10 can be physically or virtually grouped in one or more networks including but not limited to private clouds, community clouds, public clouds or hybrid clouds, or a combination thereof as described above (not shown in the figure). In this way, cloud consumers can request infrastructure as a service (IaaS), platform as a service (PaaS) and / or software as a service (SaaS) provided by the cloud computing environment 50 without having to maintain resources on local computing devices. It should be understood that Figure 1 The various types of computing devices 54A-N shown are merely illustrative, and the cloud computing node 10 and the cloud computing environment 50 may communicate with any type of computing device on any type of network and / or network-addressable connection (eg, using a web browser).

[0048] Reference now Figure 2 , which shows a cloud computing environment 50 ( Figure 1 ) provides a set of functional abstraction layers. First of all, it should be understood that Figure 2 The components, layers and functions shown are only exemplary, and the embodiments of the present invention are not limited thereto. As shown in the figure, the following layers and corresponding functions are provided:

[0049] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: host 61; server 62 based on RISC (Reduced Instruction Set Computer) architecture; server 63; blade server 64; storage device 65; network and network components 66. Examples of software components include: network application server software 67 and database software 68.

[0050] The virtualization layer 70 provides an abstraction layer that can provide examples of the following virtual entities: virtual servers 71 , virtual storage 72 , virtual networks 73 (including virtual private networks), virtual applications and operating systems 74 , and virtual clients 75 .

[0051] In one example, the management layer 80 may provide the following functions: Resource provisioning function 81: providing dynamic acquisition of computing resources and other resources for performing tasks in a cloud computing environment; Metering and pricing function 82: tracking the cost of resource usage within the cloud computing environment and providing bills and invoices for this purpose. In one example, the resource may include an application software license. Security function: providing identity authentication for cloud consumers and tasks, and providing protection for data and other resources. User portal function 83: providing access to the cloud computing environment for consumers and system administrators. Service level management function 84: providing allocation and management of cloud computing resources to meet the required service levels. Service level agreement (SLA) planning and fulfillment function 85: providing pre-arrangement and provision for future demand for cloud computing resources predicted according to the SLA.

[0052] The workload layer 90 provides examples of functions that may be implemented in a cloud computing environment. In this layer, examples of workloads or functions that may be provided include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom teaching provision 93; data analysis processing 94; and transaction processing 95.

[0053] Figure 3 is a block diagram of a data processing system 300. The data processing system 300 may be deployed in Figure 1 In cloud computing environments, for example Figure 2 The data processing system 300 is implemented in hardware and software layers 60. By way of example, data processing system 300 may be implemented as a RISC-based server 62, server 63, or blade server 64.

[0054] The data processing system 300 may include at least one processor 305 (e.g., a central processing unit) coupled to the storage element 310 via a system bus 315 or other suitable circuit. In this way, the data processing system 300 may store program codes in the storage element 310. The processor 305 may execute program codes accessed from the storage element 310 via the system bus 315. It should be understood that the data processing system 300 may be implemented in any system form. Any system includes a processor and a memory capable of performing the functions and / or operations described in this specification.

[0055] Memory element 310 may include one or more computer-readable storage media. Computer-readable storage media may be physical storage devices, such as local memory 320 and one or more mass storage devices 325. Local memory 320 refers to a random access memory (RAM) or other non-persistent storage device commonly used during the actual execution of program code. Mass storage device 325 may be implemented as a hard disk drive (HDD), a solid state drive (SSD) or other persistent data storage device. Mass storage device 325 may be maintained by the storage system of data processing system 300. Mass storage device 325 may also be outside the data processing system, such as as a component of the storage system of data processing system 300 that is linked to communication. Memory element 310 may also include one or more cache memories 330, which provide temporary storage of at least some program codes, so as to reduce the number of times program codes must be retrieved from mass storage device 325 during execution.

[0056] Input / output (I / O) devices such as display 335 and other external devices 340 (e.g., pointing devices, keyboards, etc.) may be coupled to data processing system 300. I / O devices may be coupled to data processing system 300 directly or through an intermediate I / O interface 345. For example, display 335 may be coupled to data processing system 300 through a graphics processing unit (GPU), which may be a component of processor 305 or a discrete device. One or more network adapters 350 may also be coupled to data processing system 300 to enable data processing system 300 to be coupled to other systems, computer systems, remote printers, and / or remote storage devices through an intervening private or public network. Modems, cable modems, transceivers, and Ethernet cards are examples of different types of network adapters 350 that may be used with data processing system 300.

[0057] like Figure 3 As shown, memory element 310 may store components of data processing system 300, such as at least one computer program or utility (hereinafter referred to as "program / utility") 355, which includes one or more computer program modules 360 configured to perform the processes and / or methods of the embodiments described herein. Program / utility 355 may be, for example, Figure 2 80 to provide security 86. Program / utility 355, implemented in the form of executable program code, can be executed by data processing system 300 and, as such, can be considered to be part of data processing system 300. In addition, program / utility 355 includes functional data structures (e.g., computer program modules 360) that confer functionality when used as part of data processing system 300.

[0058] Figure 4 Depicted is an example architecture 400 for a program / utility 355 that provides security 86 including data privacy awareness and protection. Figure 2 As noted, program / utility 355 may include computer program modules 360 such as data interface 402, location selector 404, workload provisioner 406, location and capability monitor 408, workload monitor 410, data privacy issue notifier 412, and data privacy constraint data 414.

[0059] Architecture 400 may also include data privacy advisor application 420 and hypervisor 422. Hypervisor 422 (also known in the art as a virtual machine monitor) is computer software, firmware, or hardware that creates and runs virtual machines. A data processing system on which a hypervisor runs one or more virtual machines is called a host, and each virtual machine is called a client computer. Program / utility 355 may be executed on a client machine, although the present arrangement is not limited thereto. Program / utility 355 may communicate with a client computer on which program / utility 355 is not executed via one or more communication networks.

[0060] In one arrangement, data privacy advisory application 420 may be a component of program / utility 355. In other arrangements, data privacy advisory application 420 may be external to program / utility 355, but program / utility 355 may be communicatively linked to data privacy advisory application 420, e.g., via one or more communications networks or system buses. For example, data privacy advisory application 420 may execute on the same data processing system on which program / utility 355 is executing (e.g., on the same guest computer or a different guest computer), or may execute on one or more data processing systems different from the data processing system on which program / utility 355 is executing.

[0061] The data interface 402 is configured to receive data privacy and workload specification input information 430. In one arrangement, the data interface 402 may be, for example, a user interface (e.g., a graphical user interface) through which a user interacts to input the data privacy and workload specification input information 430. In another arrangement, the data interface 402 may be an interface configured to access the data privacy and workload specification input information 430 from one or more data sources, such as from one or more data tables and / or one or more data files. The data privacy and workload specification input information 430 may include data privacy information 432 and workload specifications 434.

[0062] Data privacy information 432 may include attributes that indicate data privacy requirements for data to be processed by the workload provided by program / utility 355. In illustration, data privacy information 432 may specify data privacy classifications of data, for example, by using tags, annotations, and / or metadata. Examples of privacy classifications include, but are not limited to, "sensitive data," "non-sensitive data," "classified data," "confidential data," "personal data," "sensitive technology," or lower levels, such as "passport data," "social security number data," "mailing address data," "account number data," "email address data," "telephone number data," "password data," "login data," and the like.

[0063] The workload specification 434 may include attributes that indicate requirements for a system to which a workload of hosted data may be supplied. In illustration, the workload specification 434 may indicate the hardware and / or software resources that will be used to supply the workload. In one arrangement, the workload specification 434 may include attributes that specify the required hardware and / or software resources. For example, a user may enter hardware and / or software resource requirements. In another arrangement, the workload specification 434 may include attributes that specify an SLA applicable to the workload and / or data. In such an arrangement, the location selector 404 may identify the SLA specified in the workload specification 434, access the SLA from an appropriate data storage location, and identify applicable requirements for the hardware and / or software resources in the SLA.

[0064] Examples of hardware resource requirements include, but are not limited to, the number of processors, the number of processor cores, the minimum processor frequency, the minimum number of instructions per clock cycle, the minimum number of operations per second, the amount of local memory, the amount of mass storage, the amount of cache memory, etc. Examples of software resource requirements include the type of operating system, a specific operating system, a specific version of an operating system, one or more required programs (e.g., applications) and / or utilities, the required versions of one or more required programs and / or utilities, etc.

[0065] In response to receiving the data privacy information and workload specification input information 430, the location selector 404 can communicate a request indicating a workload specification to the location and capacity monitor 408. In response to the request, the location and capacity monitor 408 can communicate with the hypervisor 422 to monitor or capture location and capacity information 436, which indicates the location of the hypervisor 422 and the available workload capacity of the system (e.g., data processing system and / or storage system) running the hypervisor 422 that meets the workload specification 434. The location and capacity information 436 can also indicate the type of workload that can be deployed to the system. The location and capacity monitor 408 can communicate the location and capacity information 436 to the location selector 404.

[0066] Location selector 404 may also transmit data privacy information 432 to data privacy advisor application 420. Data privacy advisor application 420 may analyze data privacy information 432 and, based on such analysis, determine locations where workloads that will process and / or store data may be provisioned. The analysis may include accessing a data privacy policy and applying the data privacy policy to data privacy information 432.

[0067] The data privacy policy may be based on data privacy laws, data privacy regulations, and / or other data privacy rules that may be established. The data privacy policy may specify which data classifications may and may not be transmitted from a given source to various locations to which workloads may be supplied. For example, for a particular location, the data privacy policy may specify data categories from various sources that are allowed to be hosted by workloads supplied by the location, and specify data categories from various sources that are not allowed to be hosted by workloads supplied by the location. In an illustration, the data policy may indicate that data marked as "classified data" can only be supplied by workloads supplied by certain countries / regions and / or data centers that meet certain security requirements. The data policy may also indicate that data marked as "personal data" can only be hosted by workloads supplied in data centers that meet certain security requirements. In addition, the data policy may indicate that data marked as "non-sensitive" data can be hosted by workloads supplied in data centers that meet the minimum security requirement level. However, the present arrangement is not limited to these examples.

[0068] The data privacy policy can be maintained by a policy system (not shown) that applies a machine learning model to statistically parse the policy document to generate structured data and populate a relational knowledge database based on predefined patterns that are defined as important parts / elements of unstructured data that need to be further considered in the process to allow or deny policy-based operations. In the policy system, multiple documents in natural language can be analyzed to find elements that constitute the predefined knowledge database using rules with what types of data can and cannot be transmitted from a given source to a destination. The database can save entities or elements that are important parts of data or information that can or cannot be digitally transmitted as mentioned in the policy document. The database can be accessed in a variety of ways and can also be manually updated in the event of minor changes to the policies of unprocessed documents. In addition, the database can be created on the basis of joint efforts with the government to strengthen network security.

[0069] Based on the determined location, data privacy advisor application 420 may generate location permission information 438 indicating that the determined location satisfies the requirements of the data privacy policy for hosting the data. Data privacy advisor application 420 may communicate location permission information 438 to location selector 404. Data privacy advisor application 420 or location selector 404 may communicate location permission information to workload monitor 410. From location permission information 438, location selector 404 may identify a location that is permitted to provision the workload to host the data as a candidate location.

[0070] Based on the location permission information 438 and the location and capacity information 436, the location selector 404 can automatically select at least one location from the candidate locations to which the workload is to be provisioned to host the data. The selected location can be a location indicated in the location permission information 438, which is determined based on the location and capacity information 436 to meet the requirements of the data privacy policy for hosting the data and has at least one system (data processing system and / or storage system) that has available capacity to execute the workload while meeting the workload specification 434. The location selector 404 can communicate a provisioning request 440 to the workload provisioner 406 identifying the selected location and requesting that one or more workloads be provisioned at the selected location. For example, the provisioning request 440 can indicate one or more hypervisors 422 at the selected location where the workload is to be provisioned.

[0071] In response to the provisioning request 440, the workload provisioner 406 can automatically provision the workload to one or more systems at the selected location. For example, the workload provisioner 406 can communicate information about the workload being provisioned to the hypervisor 422. In response, the hypervisor 422 can automatically create one or more workloads for hosting data. For example, the hypervisor 422 can create one or more virtual machines (e.g., guest computers), microservices, and / or containers for the workload. The workload provisioner 406 can also store location and data privacy restriction information 442 related to the workload in a database, for example as data privacy constraint data 414. The database can be internal to the program / utility 355, although it does not have to be.

[0072] In addition to provisioning workloads, program / utility 355 (e.g., workload monitor 410) may also monitor workloads to ensure that the workloads are maintained in accordance with data privacy policies during the lifecycle of the workloads. In illustration, workload 450 may represent workloads that have been provisioned. As noted, workload monitor 410 may receive location permission information 438 for workload 450 from data privacy advisory application 420, and may periodically request updates to location permission information 438 from data privacy advisory application 420. Additionally, workload monitor 410 may receive data privacy information 432 from location selector 404 and / or data privacy advisory application 420, and may periodically request updates to such information.

[0073] During the workload monitoring process, for each workload 450, workload monitor 410 may determine whether there are issues with data privacy for workload 450. For example, workload monitor 410 may determine, based on data privacy information 432, whether required data privacy policies are being complied with according to predetermined criteria indicated in data privacy information 432 and / or indicated in a data privacy policy applicable to the data.

[0074] In illustration, workload monitor 410 may also determine whether workload 450 is accessed by another workload, and if so, whether the other workload is indicated in data privacy information 432 as being authorized to access specific data (e.g., sensitive data) hosted by the workload. In response to determining that the other workload is not authorized to access the specific data hosted by workload 450, workload monitor 410 may determine whether the other workload has access to the specific data hosted by workload 450. Workload monitor 410 may do so by examining a protocol implemented to access workload 450, identifying an open database connectivity (ODBC) call to workload 450, identifying a query to workload 450, identifying a marketing tool accessing workload 450, and the like. If the other workload has access to the specific data hosted by workload 450, and is not authorized to have such access, workload monitor 410 may determine that workload 450 has a data privacy concern.

[0075] In response to determining that workload 450 has issues with data privacy based on access to specific data by other workloads, workload monitor 410 may store information about workload 450, including information identifying that other workloads have access to workload 450, the manner in which other workloads access specific data hosted by workload 450, etc. Workload monitor 410 may store the information in an appropriate data store, such as a database resident in program / application 355. Workload monitor 410 may also initiate data privacy issue notifier 412 to automatically communicate a notification (e.g., an alert, text message, email, etc.) to system or compliance administrator 460 indicating that workload 450 has been accessed by an unauthorized workload, and include in the notification information about other workloads, the manner in which other workloads access specific data hosted by workload 450, etc. In addition, workload monitor 410 may communicate a request to location selector 404 in real time to select a new location to which workload 450 is to be provisioned. In response, program / utility 355 may perform the above process in real time to automatically provision workload 450 to a new location that allows workload 450 to be provisioned.

[0076] In addition, the workload monitor 410 can determine whether to continue to supply the workload 450 at the allowed location. In illustration, the workload monitor 410 can determine whether the workload 450 is currently being supplied to an allowed location that is not indicated in the location permission information 438. For example, the workload 450 may have been moved from its original location, or the monitoring process may have begun after the workload 450 has been deployed. In the event that the monitoring process is initiated after the workload 450 has been deployed, the data privacy and workload specification input information 430 can be received by the data interface 402 of the workload 450, and the location selector 404 and the data privacy advisor application 420 can perform the previously described process to generate the location permission information 438, which the data privacy advisor application 420 or the location selector 404 can communicate to the workload monitor 410. Nevertheless, in response to determining that the workload 450 is currently being supplied to a location that is not indicated in the location permission information 438 as being allowed, the workload monitor 410 can determine that there is an issue with the workload 450 regarding data privacy.

[0077] In response to determining that workload 450 has issues with data privacy based on not provisioning workload 450 in an allowed location, workload monitor 410 may store information about workload 450, including information indicating the location where the workload is provisioned, information indicating a violation of data privacy information, etc. Workload monitor 410 may store the information in a suitable data storage device, such as a database resident in program / utility 355. In addition, workload monitor 410 may initiate data privacy issue notifier 412 to automatically communicate a notification (e.g., an alert, a text message, an email, etc.) to system or compliance administrator 460 to indicate that workload 450 has been provisioned to a location that does not allow provisioning of workloads, and include in the notification information indicating the location where the workload is provisioned, information indicating a violation of data privacy information 432, etc. In addition, workload monitor 410 may communicate a request to location selector 404 in real time to select a new location to which workload 450 is to be provisioned. In response, program / utility 355 may perform the above process in real time to provision workload 450 to a new location that allows provisioning of workload 450.

[0078] Figure 5 is a flow chart illustrating an example of a method 500 of provisioning data privacy awareness and protection. At step 502, program / utility 355 may receive data privacy information related to specific data to be hosted by a workload. Program / utility 355 may also receive a workload specification for the workload.

[0079] At step 504, the program / utility 355 may identify available capacity for provisioning the workload. For example, the program / utility 355 may identify a hypervisor running on a system that has available capacity and meets the workload specifications. At step 506, the program / utility 355 may determine the location of the available capacity. For example, the program / utility 355 may identify the location of a hypervisor running on a system that has available capacity and meets the workload specifications.

[0080] At step 508, the program / utility 355 may identify locations that are allowed to provision the workload. For example, the program / utility 355 may interface with the data privacy advisor application 420 to identify those locations that are allowed to provision the workload as candidate locations. At step 510, the program / utility 355 may provision the workload to one or more of the identified locations that have available capacity. For example, the program / utility 355 may determine which candidate locations are locations that have capacity available to provision the workload while satisfying the workload specifications, and select one or more of those locations.

[0081] At step 512, the program / utility 355 may store location, data privacy, and workload information. For example, the program / utility 355 may store information such as data privacy constraint data. At step 514, the program / utility 355 may monitor the workload to determine if the workload has issues with data privacy.

[0082] Figure 6 is a flow chart illustrating an example of a method 600 for monitoring a workload to determine whether the workload has issues related to data privacy. In step 602, the program / utility 355 may determine whether the workload is accessed by another workload. In step 604, in response to determining that the workload is accessed by the other workload, the program / utility 355 may determine whether the other workload is indicated in the data privacy information as being authorized to access specific data hosted by the workload. In step 606, in response to determining that the other workload is not indicated as being authorized to access specific data hosted by the workload, the program / utility 355 may determine whether the other workload has access to specific data hosted by the workload. In step 608, in response to determining that the other workload has access to specific data hosted by the workload, the program / utility 355 may determine that the workload has issues with data privacy.

[0083] Figure 7 is a flow chart illustrating another example of a method 700 of monitoring a workload to determine whether the workload has issues related to data privacy.

[0084] At step 702, program / utility 355 may determine whether the location where the workload is provisioned is a location where provisioning of the workload is permitted based on the data privacy information. At step 704, in response to determining that the location where the workload is provisioned is a location where provisioning of the workload is not permitted, program / utility 355 may determine that there is an issue with the workload regarding data privacy.

[0085] return Figure 5 , now referring to decision box 516. At decision box 516, if the workload is not identified as having issues related to data privacy, the process can return to step 514, and the program / utility 355 can continue to monitor the workload to determine whether the workload has issues related to data privacy. However, if an issue with data privacy is identified, at step 518, the program / utility 355 can store information related to the issue, e.g., as previously described. At step 520, the program / utility 355 can automatically generate and transmit a problem notification in real time, e.g., as previously described. At step 522, the program / utility 355 can automatically provision the workload to a new location in real time, e.g., as previously described.

[0086] Although the present disclosure ends with claims defining novel features, it is believed that the various features described herein will be better understood when the description is considered in conjunction with the accompanying drawings. The process, machine, manufacture, and any variations thereof described in this disclosure are provided for illustrative purposes. Any specific structural and functional details described are not to be construed as limiting, but merely as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the described features with substantially any appropriate detailed structure. Furthermore, the terms and phrases used in this disclosure are not intended to be limiting, but rather to provide an understandable description of the described features.

[0087] For simplicity and clarity of illustration, the elements shown in the figures are not necessarily drawn to scale. For example, for clarity, the dimensions of some elements may be exaggerated relative to other elements. In addition, where deemed appropriate, reference numerals are repeated in the drawings to indicate corresponding, similar or like features.

[0088] The present invention may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to execute aspects of the present invention.

[0089] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0090] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0091] The computer program instructions for performing the operation of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present invention.

[0092] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present invention. It should be understood that each frame of the flow chart and / or block diagram and the combination of each frame in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0093] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device for implementing the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions make the computer, programmable data processing device and / or other equipment work in a specific way, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0094] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0095] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present invention. In this regard, each frame in the flow chart or block diagram can represent a part of a module, program segment or instruction, and the part of the module, program segment or instruction contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the frame can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous frames can actually be executed substantially in parallel, and they can also be executed in the opposite order sometimes, depending on the functions involved. It should also be noted that each frame in the block diagram and / or flow chart, and the combination of frames in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0096] The terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used herein, the singular forms "a", "an" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise. It will be further understood that when the terms "include (progressive)", "include (singular third person)", "include (progressive)" and / or "include (singular third person)" are used in this disclosure, it specifies the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0097] Throughout this disclosure, references to "one embodiment," "an embodiment," "an arrangement," "an arrangement," "an aspect," "an aspect," or similar language mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment described in the present disclosure. Thus, throughout this disclosure, appearances of the phrases "one embodiment," "an embodiment," "an arrangement," "an arrangement," "an aspect," "an aspect," and similar language may, but do not necessarily, all refer to the same embodiment.

[0098] As used herein, the term "multiple" is defined as two or more. As used herein, the term "another" is defined as at least the second or more. Unless otherwise specified, the term "coupling" used herein is defined as directly without any intermediate element, or indirectly connected with one or more intermediate elements. Two elements can also be mechanically, electrically or communicatively linked by a communication channel, path, network or system. As used herein, the term "and / or" refers to and encompasses any and all possible combinations of one or more associated listed items. It should also be understood that although the terms first, second, etc. can be used herein to describe various elements, these elements should not be limited by these terms, because unless otherwise specified, or the context otherwise specifies, these terms are only used to distinguish one element from another element.

[0099] The term "if" may be interpreted to mean "at the time" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [stated condition or event] is detected" may be interpreted to mean "upon determination" or "in response to determining" or "upon detection of [stated condition or event]," or "in response to detecting [stated condition or event]," depending on the context.

[0100] The descriptions set forth herein have been presented for purposes of illustration and description, but are not intended to be exhaustive or limited to the forms disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the present disclosure. The embodiments are selected and described in order to best explain the principles and practical applications of one or more aspects set forth herein, and to enable others of ordinary skill in the art to understand one or more aspects of the various embodiments described herein, with various modifications suitable for the particular use contemplated.

Claims

1. A method for data processing, comprising: receiving data privacy information related to specific data hosted by a first workload provisioned to a first location; Monitoring the first workload, wherein monitoring the first workload comprises: determining whether a second workload has accessed the first workload; In response to determining that the second workload accessed the first workload, determining whether the second workload is indicated in the data privacy information as being authorized to access the specific data hosted by the first workload; and In response to determining that the second workload is not indicated as being authorized to access the specific data hosted by the first workload, determining whether the second workload is authorized to access the specific data hosted by the first workload; and In response to determining that the second workload has access to the specific data hosted by the first workload, based on the data privacy information, automatically provisioning the first workload using a processor to a second location to which the first workload is permitted to be provisioned.

2. The method of claim 1, further comprising: In response to determining that the second workload has access to the specific data hosted by the first workload, information identifying the second workload and the manner in which the second workload accesses the specific data hosted by the first workload is stored.

3. The method of claim 1, further comprising: In response to determining that the second workload has access to the data hosted by the first workload, automatically communicating a notification to a system or compliance administrator, the notification indicating that an unauthorized workload has accessed the first workload, the notification including information identifying the second workload and the manner in which the second workload accessed the specific data hosted by the first workload.

4. The method of claim 1, wherein: The monitoring the first workload further comprises: determining, according to the data privacy information, whether the first location is a location where the first workload is allowed to be supplied; Wherein, in response to determining that the first location is not a location permitted to supply the first workload, the first workload is automatically supplied to a second location permitted to supply the first workload.

5. The method of claim 4, further comprising: A notification is automatically communicated to a system or compliance administrator indicating that the first workload has been provisioned to a location where provisioning of the first workload is not permitted.

6. The method of claim 1, further comprising: receiving a workload specification for the first workload, the workload specification for the first workload specifying resource requirements of a system to which the first workload can be provided; and determining that the second location has at least one system suitable for satisfying the workload specification of the first workload; wherein, in response to determining that the second location has at least one system suitable for satisfying the workload specification of the first workload, the first workload is automatically supplied to the second location.

7. The method of claim 1, further comprising: communicating said data privacy information relating to said specific data to a data privacy advisor application; in response to transmitting the data privacy information related to the specific data to the data privacy advisory application, receiving location permission information from the data privacy advisory application and identifying a location indicated in the location permission information as a candidate location; as well as The second position is selected from the candidate positions.

8. A system for data processing, comprising a processor programmed to initiate executable operations, the operations comprising: receiving data privacy information related to specific data hosted by a first workload provisioned to a first location; Monitoring the first workload, wherein monitoring the first workload comprises: determining whether a second workload has accessed the first workload; In response to determining that the second workload accessed the first workload, determining whether the second workload is indicated in the data privacy information as being authorized to access the specific data hosted by the first workload; and In response to determining that the second workload is not indicated as being authorized to access the specific data hosted by the first workload, determining whether the second workload is authorized to access the specific data hosted by the first workload; and In response to determining that the second workload has access to the specific data hosted by the first workload, the first workload is automatically provisioned to a second location that is permitted to provision the first workload based on the data privacy information.

9. The system of claim 8, wherein the executable operations further include: In response to determining that the second workload has access to the specific data hosted by the first workload, information identifying the second workload and the manner in which the second workload accesses the specific data hosted by the first workload is stored.

10. The system of claim 8, wherein the executable operations further include: In response to determining that the second workload has access to the data hosted by the first workload, automatically communicating a notification to a system or compliance administrator, the notification indicating that an unauthorized workload has accessed the first workload, the notification including information identifying the second workload and the manner in which the second workload accessed the specific data hosted by the first workload.

11. The system of claim 8, wherein: The monitoring the first workload further comprises: determining, according to the data privacy information, whether the first location is a location where the first workload is allowed to be supplied; Wherein, also in response to determining that the first location is not a location permitted to supply the first workload, the first workload is automatically supplied to a second location permitted to supply the first workload.

12. The system of claim 11, wherein the executable operations further include: A notification is automatically communicated to a system or compliance administrator indicating that the first workload has been provisioned to a location where provisioning of the first workload is not permitted.

13. The system of claim 8, wherein the executable operations further comprise: receiving a workload specification for the first workload, the workload specification for the first workload specifying resource requirements of a system to which the workload may be provided; and determining that the second location has at least one system suitable for satisfying the workload specification of the first workload; wherein, in response to determining that the second location has at least one system suitable for satisfying the workload specification of the first workload, the first workload is automatically supplied to the second location.

14. The system of claim 8, wherein the executable operations further comprise: communicating said data privacy information relating to said specific data to a data privacy advisor application; in response to transmitting the data privacy information related to the specific data to the data privacy advisory application, receiving location permission information from the data privacy advisory application and identifying a location indicated in the location permission information as a candidate location; as well as The second position is selected from the candidate positions.

15. A computer program product comprising: A computer-readable storage medium having program code stored thereon, wherein the program code can be executed by a data processing system to start the method according to any one of claims 1 to 7.

Images