Secure workflows that enhance data security
Methods, systems, and apparatus, including medium-encoded computer program products, for secure workflows that enhance data security are described. In one aspect, a digital component request is received. In response to receiving the digital component request, a multi-stage workflow for selecting a digital component is identified, and can include customizable stages. The execution of workflow stages includes: (A) identifying a given customizable stage; (B) for the stage: (i) identifying, a customization specific to the stage that generates an output for use in selecting the digital component; (ii) initiating an isolated execution environment for each customization; (iii) executing, within each isolated execution environment, the customization for which the isolated execution environment was initiated; and (iv) obtaining the output generated by the code of each isolated execution environment; and (C) executing a final stage to select a digital component based on the outputs. The selected digital component is sent to the client device.
1. A computer-implemented method comprising:
receiving, from a client device, a digital component request comprising a set of data;
in response to receiving the digital component request:
identifying a multi-stage workflow for selecting a digital component from candidate digital components of multiple content platforms based on the set of data, wherein the multi-stage workflow comprises one or more customizable stages;
executing each stage of the multi-stage workflow in a sequence defined by the multi-stage workflow, the executing comprising:
identifying a given customizable stage in the multi-stage workflow;
for the given customizable stage:
identifying, for each of the multiple content platforms, a customization specific to the given stage provided by the content platform, wherein each customization comprises computer-executable code that generates an output for use in selecting the digital component;
initiating an isolated execution environment for each customization;
executing, within each isolated execution environment, the computer-executable code of the customization for which the isolated execution environment was initiated; and
obtaining the output generated by the computer-executable code of each isolated execution environment; and
executing a final stage to select a digital component based on the obtained outputs; and
sending the selected digital component to the client device.
2. The computer-implemented method of claim 1 , further comprising providing a set of one or more input values for use by the computer-executable code.
3. The computer-implemented method of claim 2 , wherein at least a subset of the set of the one or more input values is provided as key, value pairs.
4. The computer-implemented method of claim 1 , wherein each isolated environment comprises a virtual machine.
5. The computer-implemented method of claim 1 , further comprising:
determining an operational metric resulting from executing at least one stage of the multi-stage workflow;
evaluating the operational metric against a constraint; and
in response to determining that operational metric satisfies the constraint, terminating execution of the at least one stage.
6. The computer-implemented method of claim 5 , wherein the operational metrics is Central Processing Unit use.
7. The computer-implemented method of claim 1 , further comprising:
receiving, from a content provider, code that implements a stage of the multi-stage workflow.
8. The computer-implemented method of claim 7 , wherein the code is encrypted.
9. The computer-implemented method of claim 1 , wherein the multi-stage workflow is defined by a workflow specification.
10. The computer-implemented method of claim 9 , wherein the workflow specification includes default code for at least one stage of the multi-stage workflow.
11. The computer-implemented method of claim 10 , wherein the default code for the at least one stage of the multi-stage workflow cannot be overridden.
12. One or more non-transitory computer-readable storage media storing instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:
receiving, from a client device, a digital component request comprising a set of data;
in response to receiving the digital component request:
identifying a multi-stage workflow for selecting a digital component from candidate digital components of multiple content platforms based on the set of data, wherein the multi-stage workflow comprises one or more customizable stages;
executing each stage of the multi-stage workflow in a sequence defined by the multi-stage workflow, the executing comprising:
identifying a given customizable stage in the multi-stage workflow;
for the given customizable stage:
identifying, for each of the multiple content platforms, a customization specific to the given stage provided by the content platform, wherein each customization comprises computer-executable code that generates an output for use in selecting the digital component;
initiating an isolated execution environment for each customization;
executing, within each isolated execution environment, the computer-executable code of the customization for which the isolated execution environment was initiated; and
obtaining the output generated by the computer-executable code of each isolated execution environment; and
executing a final stage to select a digital component based on the obtained outputs; and
sending the selected digital component to the client device.
13. A system comprising:
one or more processors; and
one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a client device, a digital component request comprising a set of data;
in response to receiving the digital component request:
identifying a multi-stage workflow for selecting a digital component from candidate digital components of multiple content platforms based on the set of data, wherein the multi-stage workflow comprises one or more customizable stages;
executing each stage of the multi-stage workflow in a sequence defined by the multi-stage workflow, the executing comprising:
identifying a given customizable stage in the multi-stage workflow;
for the given customizable stage:
identifying, for each of the multiple content platforms, a customization specific to the given stage provided by the content platform, wherein each customization comprises computer-executable code that generates an output for use in selecting the digital component;
initiating an isolated execution environment for each customization;
executing, within each isolated execution environment, the computer-executable code of the customization for which the isolated execution environment was initiated; and
obtaining the output generated by the computer-executable code of each isolated execution environment; and
executing a final stage to select a digital component based on the obtained outputs; and
sending the selected digital component to the client device.
14. The system of claim 13 , wherein the operations comprise providing a set of one or more input values for use by the computer-executable code.
15. The system of claim 14 , wherein at least a subset of the set of the one or more input values is provided as key, value pairs.
16. The system of claim 13 , wherein each isolated environment comprises a virtual machine.
17. The system of claim 13 , wherein the operations comprise:
determining an operational metric resulting from executing at least one stage of the multi-stage workflow;
evaluating the operational metric against a constraint; and
in response to determining that operational metric satisfies the constraint, terminating execution of the at least one stage.
18. The system of claim 17 , wherein the operational metrics is Central Processing Unit use.
19. The system of claim 13 , wherein the operations comprise:
receiving, from a content provider, code that implements a stage of the multi-stage workflow.
20. The system of claim 19 , wherein the code is encrypted.