106 is similar to public cloud 105, except that the computing resources are only available for use by a single enterprise. While private cloud 106 is depicted as being in communication with WAN 102, in other embodiments a private cloud may be disconnected from the internet entirely and only accessible through a local/private network. A hybrid cloud is a composition of multiple clouds of different types (for example, private, community or public cloud types), often respectively implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technology that enables orchestration, management, and/or data/application portability between the multiple constituent clouds. In this embodiment, public cloud 105 and private cloud 106 are both part of a larger hybrid cloud.

In the present disclosure, use of the term “a,” “an”, or “the” is intended to include the plural forms as well, unless the context clearly indicates otherwise. Also, the term “includes,” “including,” “comprises,” “comprising,” “have,” or “having” when used in this disclosure specifies the presence of the stated elements, but do not preclude the presence or addition of other elements.

As used herein, the term “sensitive data” refers to any type of information that, if disclosed or compromised, could cause harm, damage, or significant consequences to individuals, organizations, or even national security. It typically includes personally identifiable information such as names, addresses, social security numbers, financial data, medical records, login credentials, or any other data that can be used to identify, discriminate against, or harm individuals. Additionally, sensitive data can encompass trade secrets, intellectual property, classified government information, proprietary business data, or any other confidential information that, if exposed, could lead to financial loss, reputational damage, legal ramifications, etc. The protection of sensitive data can be crucial to maintain privacy, security, or trust in various sectors, including healthcare, finance, government, and technology.

In places with stringent data protection regulations, the transfer of data between different data centers can be highly restricted, posing significant challenges for data analysis processes that necessitate access to and examination of data from multiple locations. Within a specific jurisdiction, employees might be required to undergo meticulous reviews and obtain permissions to access such data, incurring substantial costs. Transferring data beyond the jurisdiction's boundaries can prove exceedingly arduous.

Efficient and secure data management and transfer can be pivotal in numerous industries, as they ensure the safeguarding of sensitive information and enable effective data analysis. In today's interconnected global landscape, organizations typically rely on seamless data exchange between diverse data centers to drive innovation and informed decision-making. However, these data transfer constraints can hinder these processes, particularly in sectors where comprehensive data analysis is vital.

Embodiments of the present invention disclose an approach for data security and management. Specifically, the approach involves managing the analysis of sensitive data across multiple data centers. The system includes a data location repository that stores and updates information regarding the locations of sensitive data in data centers. When a request to access sensitive data from an analysis process is received, a specific data center where the data is stored is identified. The necessary components of the analysis process are transferred to that data center. The migrated analysis process is then executed using the locally stored sensitive data, without physically transferring the data. The generated analysis results are transferred back to the original data center where the analysis process originated.

Existing data migration solutions often involve the transmission of sensitive data from one location to another, which poses significant security risks. Such data transfers can expose sensitive information to various threats, including interception, data breaches, and unauthorized access. The present invention introduces a novel system and method for secure in-place process migration of sensitive data. The system allows data processing and analysis tasks to be migrated without the need to physically transfer the underlying sensitive data. When a process requires access to sensitive data residing in a different data center, this system can seamlessly migrate the process to the specific data center where the necessary data is stored. Once relocated, the process can gain the ability to work directly with the sensitive data without any physical transfer, ensuring data security. Importantly, the sensitive data in the original center remains protected, as it cannot be moved to another location through process migration. The system can facilitate the efficient migration of analysis results back to the originating data center. This approach ensures both security and flexibility, enabling organizations to harness the advantages of sensitive data analysis across multiple data centers while maintaining stringent data protection measures.

As used herein, “process migration” refers to the secure and efficient relocation of a data processing task or workflow from one computing environment or location to another within the same system, all while safeguarding sensitive data. This migration process can entail transferring the computational instructions and associated processing state while keeping the sensitive data in its original location or in secure virtualized containers, thereby eliminating the need for direct data transfer and ensuring data security. This innovative process migration system can facilitate workload redistribution and resource optimization without compromising data integrity and confidentiality.

FIG. 2 depicts a block diagram of one or more components of a system environment 200 by which services are provided by a process migration engine 250, in accordance with an embodiment of the present disclosure. In accordance with some embodiments, the process migration engine 250 is configured to provide for secure in-place process migration of sensitive data. As shown, process migration engine 250 includes data location repository module 260, process migration module 262, data analysis module 264, monitoring module 266, and result migration module 268.

As used herein, an “engine” can refer to a hardware processing circuit, which can include any or some combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, a digital signal processor, or another hardware processing circuit. Alternatively, an “engine” can refer to a combination of a hardware processing circuit and machine-readable instructions (software and/or firmware) executable on the hardware processing circuit.

FIGS. 3-7 will be used to walk through an embodiment of the present invention, emphasizing the interconnected nature of these figures. The deliberate linkage between these figures creates a seamless transition from one to the next. This deliberate arrangement serves to illustrate that each figure is an integral part of an overall process, contributing to a comprehensive understanding of the present invention's methodology. FIGS. 3-7 demonstrate how each figure naturally flows from its predecessor, forming a continuous narrative that elucidates the entire process.

FIG. 3 depicts a diagram 300 illustrating sensitive data 310 located at data center A 305 and sensitive data 320 located at data center B 310. As used herein, a “data center” refers to a physical or virtual facility where sensitive data can be stored and managed. It is a component of the system's infrastructure, and its role can include securely housing and maintaining the hardware and software resources required for storing, processing, and managing sensitive data. Specifically, a data center is where the actual data repositories are located.

Data location repository module 260 is configured to maintain data location information in a data location repository. To that end, data location repository module 260 can continually gather, organize, and store comprehensive information regarding the location of sensitive data within the system. It can ensure that all relevant data centers and their associated data repositories are documented and accounted for by constantly monitoring and recording data movements in real-time.

Data location repository module 260 is further configured to handle the dynamic nature of data storage within the system. It can monitor and update details about the specific data centers where sensitive data is stored. This can include changes in data center locations, additions or removals of data repositories, and/or updates to the data center's operational status. In essence, data location repository module 260 can act as the system's data map, keeping a record of where sensitive data resides, and it ensures that this information remains current and accurate.

FIG. 4 depicts a diagram 400 illustrating sensitive data 310 located at data center A 305, along with analysis process 330. As used herein, “analysis process” refers to a systematic and structured approach used to examine, evaluate, and interpret data, information, or a particular subject matter in order to gain a deeper understanding, draw meaningful conclusions, make informed decisions, and/or the like. This process typically involves breaking down complex information into manageable components, identifying patterns, relationships, and trends, and applying relevant methodologies or tools to extract insights. It can encompass a wide range of fields, including data analysis, financial analysis, scientific research, and even critical thinking in everyday life.

The key steps in an analysis process generally involve defining the problem or objective, collecting relevant data, organizing and cleaning the data, applying appropriate techniques or models, and presenting the findings in a clear and concise manner. The goal of the analysis process is typically to transform raw information into valuable knowledge, enabling individuals or organizations to make informed choices, solve problems, and/or optimize their operations. It can serve as a crucial tool for decision-making and problem-solving in various domains.

The analysis process within this system can be initiated in any data center that is capable of running it. Once the process is started, the system takes on the responsibility of monitoring the data that needs to be accessed by this process. For instance, it achieves this by closely inspecting the input parameters of functions that are called by the process, such as “fopen”. The fopen( ) method in the C programming language is a library function that is used to open a file to perform various operations which include reading, writing, etc. By monitoring these inputs, the system can determine which sensitive data files are being accessed and where they are located. This allows the system to ensure that the necessary data is available in the same data center where the process is being executed.

Process migration module 262 is configured to manage the relocation of computing processes that necessitate access to data stored across various data centers. It can ensure a secure and efficient migration process by orchestrating the transfer of computing processes to the precise data center where the necessary data is stored. By facilitating the transfer of computing processes to the specific data center where the relevant data is located, process migration module 262 can minimize the complexities associated with data access and enhances overall system performance.

One of the distinguishing features of this module is its capacity to understand the sensitivity of the data stored in different data centers. It can categorize data into sensitivity levels (e.g., sensitive, private, or public). This categorization can be instrumental in guiding the module's decision-making during the migration process. It can empower process migration module 262 to make informed choices regarding where and how to access data, ensuring that sensitive data is retrieved only from authorized and secure locations.

FIG. 5 depicts a diagram 500 illustrating sensitive data 310 located at data center A 305, analysis process 330 located at data center A 305, and sensitive data 320 located at data center B 310. Sensitive data 310 and sensitive data 320 is overseen by data location repository module 260, which maintains a detailed record of the whereabouts of sensitive data. Process migration module 262 determines that when analysis process 330 is engaged in data analysis, it specifically requires access to the sensitive data 320, which is housed in data center B 310. Sensitive data 320 is essential for analysis process 330 to effectively carry out its tasks.

The awareness of data sensitivity and location can create a dynamic framework for process migration module 262 to operate within. It can allow for tailored, context-specific migration strategies that prioritize security and data integrity. Process migration module 262 actions are not only efficient but also can be aligned with data governance and compliance requirements, thereby contributing to the overall reliability and stability of the computing environment.

Process migration module 262 can facilitate the seamless migration of the necessary processes to the specific data center where the required sensitive data resides. Instead of physically moving the data, process migration module 262 can transfer the analysis process, ensuring that it operates directly on the data within its original storage location. This approach minimizes the risk associated with data transfer, maintaining the confidentiality and integrity of the sensitive information.

Data analysis module 264 is configured to facilitate data analysis processes across various data centers. One function is to enable the execution of these processes in a streamlined and efficient manner. This functionality can eliminate the need for data to be physically transferred between data centers, which not only saves time but also enhances data security. By allowing the analysis to take place directly within the data center where the information is stored, data analysis module 264 can mitigate the risks associated with data transportation and ensures that sensitive data remains securely contained within its designated location.

FIG. 6 depicts a diagram 600 illustrating sensitive data