Secure Workflow Execution in Isolated Virtual Machines

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing computing systems face challenges in ensuring data privacy and system integrity while allowing proprietary code from multiple content platforms to execute on sensitive user data without unauthorized access or data breaches.

Innovation Solution

A secure distribution system executes workflows in isolated virtual machines, encrypting and isolating customizations from content platforms to protect user privacy and maintain system integrity, ensuring that each customization accesses only authorized data and meets validity constraints.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If proprietary code from multiple content platforms is executed on sensitive user data, then workflow customization and functionality are improved, but data privacy and system integrity are compromised

Engineering Contradiction:

Improveworkflow customizationVSAvoiddata privacy

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system divides the execution environment into separate virtual machines, with each VM isolating code from a specific content platform. This segmentation allows multiple proprietary codes to execute simultaneously without interfering with each other or accessing data they are not authorized for, thus maintaining data privacy while enabling workflow customization.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces a virtual machine as an intermediary layer between the proprietary code and the sensitive user data. The virtual machine acts as a sandbox that allows code execution while controlling and limiting access to data, ensuring that code can process data privacy constraints without directly accessing or leaking the data.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If proprietary code is allowed to access user data, then workflow functionality is enhanced, but unauthorized data access and breaches occur

Engineering Contradiction:

Improvecode execution capabilityVSAvoidunauthorized data access

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Each content platform's code is executed in a separate virtual machine, creating isolation barriers that prevent unauthorized access between different codes and their data. The segmentation ensures that code from one platform cannot access data intended for another platform, eliminating cross-contamination and unauthorized data breaches.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system implements selective data access rights where each virtual machine has localized access to specific data based on the workflow stage and platform requirements. This local quality approach allows code to access only the data it needs for its specific function while preventing broader unauthorized access across the system.

Inventive Principle:

Principle #3Local quality

3Productivity

If code from multiple content platforms executes simultaneously, then workflow processing capability is improved, but system complexity and interference increase

Engineering Contradiction:

Improveworkflow processing capabilityVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system uses separate virtual machines for each content platform's code execution, allowing simultaneous processing of multiple workflows without interference. Each virtual machine is an independent container that manages its own resources, which simplifies the overall system architecture by isolating complexity within individual VMs rather than requiring complex coordination between shared code processes.

Inventive Principle:

Principle #1Segmentation

4Adaptability or versatility

If customization code is shared between platforms, then workflow adaptability is improved, but code security and confidentiality are compromised

Engineering Contradiction:

Improvecode reusabilityVSAvoidcode confidentiality

Core Design Contradiction:

Adaptability or versatilityVSLoss of information

Solution Approach 1:

The system maintains separate virtual machines for each content platform's code, ensuring that proprietary customization code remains confidential and isolated. Even though code can be reused across platforms through the workflow framework, the virtual machine isolation prevents any leakage or unauthorized sharing of the actual code implementations between different content platforms.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20250328632A1Secure workflows that enhance data security

Publication Date: 2025.10.23 GOOGLE LLC

AI summary

Methods, systems, and apparatus, including medium-encoded computer program products, for secure workflows that enhance data security are described. In one aspect, a digital component request is received. In response to receiving the digital component request, a multi-stage workflow for selecting a digital component is identified, and can include customizable stages. The execution of workflow stages includes: (A) identifying a given customizable stage; (B) for the stage: (i) identifying, a customization specific to the stage that generates an output for use in selecting the digital component; (ii) initiating an isolated execution environment for each customization; (iii) executing, within each isolated execution environment, the customization for which the isolated execution environment was initiated; and (iv) obtaining the output generated by the code of each isolated execution environment; and (C) executing a final stage to select a digital component based on the outputs. The selected digital component is sent to the client device.