Data protected process cores
AssigneeInternational Business Machines Corporation
InventorsCorville O. Allen, Lee N. Helgeson, Russel L. Young
Life of this patent
Estimating the term…
Abstract
Embodiments provided in this disclosure include a method, computer program product, and system for protecting sensitive data in a processing system comprising a plurality of processor cores. The method includes designating at least one processor core for processing sensitive data, and during a dump event, capturing data from each of the plurality of processor cores except the designated processor core to prevent unauthorized access to sensitive data.
Claims20
A computer-implemented method to prevent commingling of sensitive and non-sensitive data during a dump event responsive to an operating system failure in a processing environment virtualized over a plurality of processor cores of a plurality of networked processing systems, the computer-implemented method comprising:
- providing, at least in part, resources virtualized over a plurality of processor cores, including a first processor core designated for processing sensitive data and a second processor core not designated for processing sensitive data, wherein the virtualized resources are assigned to a plurality of virtual machines by a hypervisor configured to execute the plurality of virtual machines;
- providing a memory shared by the plurality of processor cores;
- and
- responsive to a failure of an operating system executing in a first of the plurality of virtual machines, the operating system having a plurality of executing applications including a first application, performing a dump event, comprising, upon determining that dumping of the sensitive data is not authorized, capturing non-sensitive data, accessible by the operating system, from both a second memory dedicated to the second processor core and the shared memory, while preventing capture of data, accessible by the operating system, from one or more portions designated as sensitive in both a first memory dedicated to the first processor core and the shared memory, in order to prevent commingling of the sensitive and non-sensitive data during the dump event.
A computer-implemented method to prevent commingling of sensitive and non-sensitive data during a dump event responsive to an operating system failure in a processing environment virtualized over a plurality of processor cores of a plurality of networked processing systems, the computer-implemented method comprising:
- providing, at least in part, resources virtualized over a plurality of processor cores initially designated for processing sensitive data, the plurality of processor cores including a first processor core and a second processor core, wherein the virtualized resources are assigned to a plurality of virtual machines by a hypervisor configured to execute the plurality of virtual machines;
- providing a memory shared by the plurality of processor cores;
- subsequent to processing sensitive data by the first and second processor cores, designating the second processor core as no longer being authorized to process any sensitive data, whereafter the second processor core no longer processes any sensitive data;
- and
- responsive to a failure of an operating system executing in a first of the plurality of virtual machines, the operating system having a plurality of executing applications including a first application, performing a dump event, comprising:
- upon determining that dumping of the sensitive data is not authorized, capturing non-sensitive data from both a second memory dedicated to the second processor core and the shared memory, while preventing capture of data from one or more portions designated as sensitive in both a first memory dedicated to the first processor core and the shared memory, in order to prevent commingling of the sensitive and non-sensitive data during the dump event when dumping of the sensitive data is not authorized.
Dependencies are inferred from the claim text.