RESTRICTING ACCESS TO SENSITIVE DATA IN SYSTEM MEMORY DUMPS

• US 20150113240A1
• Filed: 10/17/2013
• Published: 04/23/2015
• Est. Priority Date: 10/17/2013
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Abrams, Robert M., Grech, Anthony S.
• Application Number:
  US14/056,080
• Publication Number:
  US 20150113240A1
• Time in Patent Office: Days
• US Class Current: 711/163
• CPC Class Codes: G06F 12/0253 Garbage collection, i.e. reclamation of unreferenced memory
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/702 Conservative garbage collection

Abstract

Embodiments relate to restricting access to sensitive data in system memory dumps. An aspect includes defining a memory object containing sensitive data as a secure memory object. The secure memory object is then designated to be included or excluded in system memory dumps. The secure memory object is omitted from system memory dumps if the secure memory object is designated to be excluded. On the other hand, the secure memory object is included in system memory dumps if the secure memory object is designated to be included. Although the secure memory object may be included in the system memory dump, access to the secure memory object is prevented unless a cipher is provided.

Claims

1-6. -6. (canceled)

7. A computer system for restricting access to sensitive data in system memory dumps, comprising:

a memory having computer readable computer instructions and a processor for executing the computer readable instructions to perform a method comprising;

defining a memory object containing sensitive data as a secure memory object;

designating whether the secure memory object should be included or excluded in a system memory dump;

omitting the secure memory object from the system memory dump based on a designation that the secure memory object should be excluded; and

including the secure memory object in the system memory dump based on a designation that the secure memory object should be included.

8. The computer system of claim 7, wherein the defining of the secure memory object further comprises setting an attribute in a header of the memory object.

9. The computer system of claim 7, wherein the designating further comprises setting an attribute in the header of the secure memory object.

10. The computer system of claim 7, wherein the including of the secure memory object in the system memory dump further comprises preventing access to the secure memory object.

11. The computer system of claim 7, wherein the including of the secure memory object in the system memory dump further comprises allowing access to the secure memory object when a cipher is provided.

12. The computer system of claim 7, further comprising referencing each sensitive data object in the secure memory object with a tag in a reference table.

13-18. -18. (canceled)