Virtual Application Orchestration for Secure Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for ensuring secure application use while preventing unauthorized data sharing rely on trust agreements that are unenforceable and require decryption, risking data access by application owners.
Innovation Solution
Implement orchestration logic using public/private key combinations to secure applications in a virtual environment, preventing data owners and application owners from accessing each other's data by disabling private keys upon application loading.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is used to protect consumer data, then data security is improved, but the data must be decrypted for processing which reveals the data to the application
Solution Approach 1:
The patent introduces an intermediary decryption component that acts as a mediator between the encrypted data and the application. This component decrypts data in a secure environment and passes only the processed results to the application, preventing the application from directly accessing or possessing the original consumer data. The intermediary ensures data security while enabling necessary processing.
Solution Approach 2:
The system segments the data processing architecture into distinct components: an encrypted data storage layer, a decryption layer with controlled access, and an application layer. This segmentation ensures that the application operates in isolation from the decrypted data, maintaining security boundaries while allowing processing to occur in the appropriate layer.
2Reliability
If trust agreements are used to prevent unauthorized data access, then contractual protection is provided, but they do not technically prevent the application owner from accessing consumer data
Solution Approach 1:
The patent replaces the mechanical/legal system of trust agreements with a technical/cryptographic system. Instead of relying on contractual promises, the system uses cryptographic controls, access permissions, and architectural design to technically enforce data protection. This substitution transforms soft contractual obligations into hard technical constraints that cannot be violated.
3Adaptability or versatility
If the application is made available to multiple parties for use, then application utility is improved, but the application owner loses control over data access
Solution Approach 1:
The patent creates a universal secure processing framework that can serve multiple application owners and consumers simultaneously. The same cryptographic infrastructure and secure processing architecture can be applied across different applications and data sets, enabling broad utility while maintaining consistent control mechanisms. The system is designed to handle multiple parties without requiring separate control systems for each.
Data Source
AI summary
Disclosed are methods and systems for orchestrating application use while preventing unauthorized data sharing. For instance, an orchestration management system may provide orchestration logic to a computing platform system hosting a virtual environment configured to run an application on behalf of a data owner computing device. Once the orchestration logic is loaded thereon, a public key to and a location of the virtual environment may be provided to an application owner's computing device. The orchestration logic may enable the application owner's computing device to access the virtual environment at the location to load the application into the virtual environment utilizing a first key combination including the public key and a matching private key. At least the private key may then be disabled by the orchestration logic to prevent subsequent access to the virtual environment by the application owner to guarantee no unauthorized data sharing.