Distributed Application Execution for Confidential Data Security

Solution Overview

Problem

Migrating applications that consume confidential data to cloud computing systems is challenging due to data security concerns, as tenants are reluctant to share sensitive information with cloud service providers, and cloud providers are hesitant to host such data due to legal and security risks.

Innovation Solution

Implementing a distributed execution framework that partitions applications into components based on data types, allowing sensitive data to be processed locally while non-confidential data is shared with the cloud, with a control layer managing data transmission and ensuring compliance with tenant policies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If applications consuming confidential data are migrated to cloud computing systems, then scalability and resource sharing are improved, but data security and tenant control are worsened

Engineering Contradiction:

ImprovescalabilityVSAvoiddata security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The application is divided into multiple components based on data sensitivity. Components that process confidential data are executed locally at the tenant's computing facility, while components that process non-confidential data are executed in the cloud. This segmentation allows the system to maintain scalability through cloud resources while ensuring data security by keeping sensitive processing local.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different execution locations are assigned to different application components based on their data requirements. Components requiring access to confidential data are deployed locally to maintain tenant control and security, while components that can operate with shared or public data are deployed in the cloud for scalability and resource sharing.

Inventive Principle:

Principle #3Local quality

2Productivity

If confidential data is shared with cloud service providers for processing, then cloud computing capabilities are improved, but tenant control and data privacy are worsened

Engineering Contradiction:

Improvecloud computing capabilitiesVSAvoidtenant control

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The application is divided into multiple components based on data sensitivity. Components that process confidential data are executed locally at the tenant's computing facility, while components that process non-confidential data are executed in the cloud. This segmentation allows the system to maintain scalability through cloud resources while ensuring data security by keeping sensitive processing local.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A control layer is introduced as an intermediary between the application components and the cloud infrastructure. This control layer manages data transmission, authorizes access, and ensures that only non-confidential data is shared with the cloud, while confidential data remains under tenant control at the local facility.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If applications requiring data from multiple tenants are deployed, then functionality and analysis capabilities are improved, but data sharing restrictions and deployment feasibility are worsened

Engineering Contradiction:

Improveanalysis capabilitiesVSAvoiddeployment feasibility

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

The application is divided into multiple components based on data sensitivity. Components that process confidential data are executed locally at the tenant's computing facility, while components that process non-confidential data are executed in the cloud. This segmentation allows the system to maintain scalability through cloud resources while ensuring data security by keeping sensitive processing local.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The distributed execution framework provides a universal solution that can handle applications requiring data from multiple tenants. By enabling components to execute at different locations (cloud or local) based on data requirements, the system can support federated data analysis across multiple tenants while respecting their individual data sharing restrictions and privacy requirements.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20230325264A1Distributed application execution for cloud computing

Publication Date: 2023.10.12 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Cloud computing techniques utilizing distributed application execution are disclosed herein. One example technique includes receiving a command to launch an application, and in response, determining an execution location corresponding to a type of data consumed by individual components of the application. Upon determining that one of the components is to be executed in a local computing facility, the example technique includes transmitting, from a public computing facility to the local computing facility, a request to execute the one of the components in the local computing facility instead of the public computing facility. Upon being authorized by the local computing facility, data is requested and received from the one of the components executed at the local computing facility without having direct access from the public computing facility to a data source at the local computing facility.