Patent ID: 8032924

Claim:
A method for verifying privacy policy compliance of a workflow in a distributed stream processing system, comprising: assigning, by using a processor, a read label to a user, wherein the read label of the user includes a risk level for data readable by the user; assigning, by using the processor, read and write labels to processing components, wherein a processing component receives data and includes a program that transforms the data to produce new data as output, the read label of a processing component includes a risk level for data readable by the processing component and the write label of a processing component includes a risk level of data written from the processing component; assigning, by using the processor, channel labels to channels, wherein channels connect the processing components to other processing components, external data sources or the user and the channel labels identify a risk level of data readable by the channel; generating, by using the processor, a workflow, wherein the workflow includes first and second processing components, first and second channels and the user, wherein the first and second processing components are connected to each other by the first channel and the second channel connects an output of the second processing component to the user, wherein the first processing component, the first channel, the second processing component, the second channel and the user are sequentially connected; determining, by using the processor, if the workflow satisfies the following numbered conditions: (1) the read label of the second processing component dominates the channel label of the first channel, (2) the write label of the first processing component dominates the channel label of the first channel, (3) the write label of the first processing component dominates the read label of the first processing component, (4) the write label of the second processing component dominates the channel label of the second channel, (5) the write label of the second processing component dominates the read label of the second processing component and (6) the read label of the user dominates the channel labels of the first and second channels, wherein a label dominates another label when its risk level is greater than that of the another label and the label does not dominate the another label when its risk level is less than that of the another label; verifying, by using the processor, that the workflow is in compliance with a privacy policy of the distributed stream processing system when the conditions 1-6 are affirmatively satisfied; and accepting, by using the processor, the workflow such that the output of the second processing component is readable by the user.