Patent ID: 9047490
Filing Date: 2015-06-02
Classification: G06F

Abstract:
1. A method for a secure execution of workflow tasks of a workflow to be executed according to an execution pattern in a distributed workflow management system within a decentralized network system with a plurality of servers (b 0 , b 1 , . . . , b n )including at least an initiator server and at least one or more groups of servers, the execution pattern being stateless such that, upon completion of required workflow tasks, each server sends all workflow data to a next server and is able to go offline during a remainder of the execution pattern, the initiator server executing a first set of the workflow tasks, each of the one or more groups of servers satisfying a policy (pol i ) of a vertex (v i ), and thus, knowing a corresponding policy key pair including a policy private key (SK poli ) and a policy public key (PK poli ), wherein each vertex (v i ) denotes a set of workflow tasks to be executed in accordance with the execution pattern and is assigned a vertex key pair including a vertex private key (SK i ) and a vertex public key (PK i ), and wherein vertex private keys and policy public keys are jointly encrypted within a first onion structure (O d ), the first onion structure (O d ) being built up of a number of onion layers representing the execution pattern that defines a succession of vertices such that each onion layer is decryptable by using the policy private key of exactly one vertex (v i ), thus revealing a corresponding vertex private key (SK i ), the method comprising, starting at an i'th server, the i'th server being different than the initiator server, being a server of one of the one or more groups of servers, and being assigned at runtime based on a service discovery mechanism in accordance with the execution pattern to execute one vertex of the workflow, the policy comprising credentials the i'th server satisfies in order to be assigned to a respective vertex, called herein the i'th vertex, at least the following operations: receiving, over a network at the i'th server, the first onion structure (O receiving, over the network at the i'th server, the workflow originating from the initiator server, the workflow including all of the workflow data, wherein all of the workflow data includes a subset of workflow data encoded by an i'th vertex public key (PK decoding, at the i'th server, the i'th vertex private key (SK decoding, at the i'th server, the workflow data encoded by the i'th vertex public key (PK processing, at the i'th server, a second onion structure (O encoding, at the i'th server, the second onion structure (O based on verifying, executing the i'th vertex (v updating, at the i'th server, the workflow according to an executed i'th vertex (v assigning at least one (i+1)'th server of one of the one or more groups of servers based on the service discovery mechanism in accord with the execution pattern; and sending the updated workflow, a partly decoded first onion structure (O