Rule-Based Workflow Isolation for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in balancing data privacy and utility while ensuring the confidentiality and integrity of proprietary content platform logic, particularly when executing workflows across multiple platforms.
Innovation Solution
A secure distribution system executes workflows in isolated virtual machines, encrypting and isolating customizations from each content platform to ensure data privacy and integrity, and enforces access rules to control data access at a granular level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If workflows are executed across multiple content platforms to enable data sharing and customization, then data utility and platform functionality are improved, but data privacy and platform logic confidentiality are compromised
Solution Approach 1:
The system segments the workflow execution environment into isolated virtual machines for each content platform. Each virtual machine executes platform-specific logic in isolation, preventing cross-platform data leakage while allowing customized workflow stages. The segmentation separates the workflow coordinator (trusted party) from the platform logic executors, enabling versatility without compromising privacy.
Solution Approach 2:
A trusted workflow coordinator acts as an intermediary between multiple content platforms and users. The coordinator manages workflow execution, handles data requests, and coordinates between platforms without exposing raw user data to platforms or platform logic to users. This intermediary enables data utility while preserving confidentiality through controlled information flow.
2Adaptability or versatility
If proprietary logic from multiple content platforms is executed to enable customized workflows, then workflow functionality is improved, but system security and logic confidentiality are worsened
Solution Approach 1:
Each content platform's logic is executed in a separate virtual machine instance, creating isolated execution environments. This segmentation allows multiple platforms to be integrated into a unified workflow while maintaining logical confidentiality and system integrity. The virtual machine boundaries prevent any single platform from accessing or corrupting another platform's logic.
Solution Approach 2:
Virtual machines create an inert, controlled execution environment for each content platform's logic. The isolated environment prevents malicious or erroneous logic from one platform from affecting the system's overall integrity. The trusted workflow coordinator maintains system-wide reliability by managing these isolated environments and controlling data flow between them.
3Productivity
If user data is shared across multiple platforms for workflow processing, then data utility is improved, but network bandwidth and computational resource consumption increase
Solution Approach 1:
The system extracts and processes only the specific data elements required for each workflow stage, rather than transferring entire datasets between platforms. The workflow coordinator requests only necessary data from users and platforms, reducing network bandwidth consumption while maintaining processing efficiency. Unnecessary data transfers are eliminated through precise data request filtering.
Solution Approach 2:
User data is collected and prepared in advance by the workflow coordinator before being passed to content platforms. This preliminary action consolidates data processing, reducing redundant computations and network transfers. The coordinator pre-processes data to the required format, minimizing the computational burden on individual platforms and reducing overall resource consumption.
Data Source
AI summary
Methods, systems, and apparatus, including medium-encoded computer program products, for providing secure workflows with rule-based data access security are described. In one aspect, a method includes receiving a digital component (DC) request. A workflow, which can include customizable stages, for selecting a DC is identified. Stages can include executable instructions and can be executed as defined by the workflow. The method can include, for each stage: initiating an isolated environment, receiving a data access request and, for each request, obtaining access rules associated with the request, processing access rules to determine whether to return the data requested by the request, and whenever it is determined to return the data, providing the data to the isolated environment. The method can include, receiving output data from customizable stages and selecting, using a stage and based on the output data received, a DC, which can be sent to the client device.