# US 10,372,925 B2 · Data protected process cores > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,925 B2 - Document ID: US10372925B2 - Status: Granted - Kind: B2 - Application number: 14/566,967 - Filed: 2014-12-11 - Published: 2016-01-14 - Granted: 2019-08-06 - Earliest claimed: 2014-07-08 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Corville O. Allen; Lee N. Helgeson; Russel L. Young - Web page: https://patentgrep.com/patent/US10372925B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/75: by inhibiting the analysis of circuitry or operation - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments provided in this disclosure include a method, computer program product, and system for protecting sensitive data in a processing system comprising a plurality of processor cores. The method includes designating at least one processor core for processing sensitive data, and during a dump event, capturing data from each of the plurality of processor cores except the designated processor core to prevent unauthorized access to sensitive data. ## Claims ### Claim 1 A computer-implemented method to prevent commingling of sensitive and non-sensitive data during a dump event responsive to an operating system failure in a processing environment virtualized over a plurality of processor cores of a plurality of networked processing systems, the computer-implemented method comprising: providing, at least in part, resources virtualized over a plurality of processor cores, including a first processor core designated for processing sensitive data and a second processor core not designated for processing sensitive data, wherein the virtualized resources are assigned to a plurality of virtual machines by a hypervisor configured to execute the plurality of virtual machines; providing a memory shared by the plurality of processor cores; and responsive to a failure of an operating system executing in a first of the plurality of virtual machines, the operating system having a plurality of executing applications including a first application, performing a dump event, comprising, upon determining that dumping of the sensitive data is not authorized, capturing non-sensitive data, accessible by the operating system, from both a second memory dedicated to the second processor core and the shared memory, while preventing capture of data, accessible by the operating system, from one or more portions designated as sensitive in both a first memory dedicated to the first processor core and the shared memory, in order to prevent commingling of the sensitive and non-sensitive data during the dump event. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the sensitive data is protected health information (PHI). ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving an indication from the first application on whether the first application requires processing sensitive data; and based on the indication, selecting one or more processor cores of the plurality of processor cores to execute the first application. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein a service module performs capturing data during the dump event, wherein data is captured from the one or more portions of the first memory that are designated as sensitive and only when the service module includes a key permitting dumping of the sensitive data. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further configured to access a profile corresponding to the first memory that indicates which portions of the first memory contain sensitive data. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the hypervisor executes on the first system, wherein the dump event is performed by a service module of the first system, wherein the service module is configured to, in performing the dump event: upon determining that dumping of the sensitive data is authorized, capture both sensitive and non-sensitive data from each of the first memory, the second memory, and the shared memory. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the service module includes hardware separate from the plurality of processor cores, wherein the dump event comprises a core dump event, wherein the failure of the operating system is caused by, in respective instances, a hardware error, an operating system error, and an application error, wherein the computer-implemented method further comprises: performing a predefined operation for the first virtual machine in order to capture a snapshot of a then-current state of the first processing system at a time of the failure, the predefined operation including the dump event, wherein the predefined operation is, in respective instances, a diagnostic operation and a debugging operation; wherein the dump event includes taking a snapshot of each of a register file, a cache, one or more memory modules, and a storage device, the one or more memory modules including the first memory, the second memory, and the shared memory. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein performing the dump event further comprises: upon determining that dumping of the sensitive data is not authorized, capturing non-sensitive data, accessible by the operating system, from each of the register file, the cache, and the storage device, while preventing capture of data, accessible by the operating system, from at least one portion designated as sensitive in each of the register file, the cache, and the storage device, in order to prevent commingling of the sensitive and non-sensitive data during the dump event; upon determining that dumping of the sensitive data is authorized, capture both sensitive and non-sensitive data, accessible by the operating system, from each of the register file, the cache, and the storage device; and determining, based on both of a core profile and a memory profile of the processing environment, whether dumping of the sensitive data is authorized. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the first processor core designated for processing sensitive data is permitted to process both sensitive data and non-sensitive data; wherein the second processor core not designated for processing sensitive data is permitted to process non-sensitive data and is not permitted to process sensitive data; wherein each of the core profile and the memory profile specify locations of the one or more portions designated as sensitive in each of the first memory, the second memory, and the shared memory. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein that dumping of the sensitive data is authorized is determined based further on the service module having a predefined key required to authorize dumping of the sensitive data. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the service module is coupled to the plurality of processor cores, wherein the plurality of processor cores includes a third processor core, wherein the sensitive data is protected health information (PHI), wherein the service module is further configured to: prior to executing the first application, determine, based on an access profile for the first application, whether the first application requires processing sensitive data; and based on the determination of whether the first application requires processing sensitive data, select one or more of the plurality of processor cores to execute the first application, the one or more of the plurality of processor cores including the first and second processor cores. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, further comprising: performing a predefined operation for the first virtual machine in order to capture a snapshot of a then-current state of the first processing system at a time of the failure, the predefined operation including the dump event. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the predefined operation comprises a diagnostic operation. ### Claim 14 (depends on 12) The computer-implemented method of claim 12, wherein the predefined operation comprises a debugging operation. ### Claim 15 (depends on 1) The computer-implemented method of claim 1, wherein performing the dump event further comprises: determining, based on a core profile of the processing environment, whether dumping of the sensitive data is authorized. ### Claim 16 (depends on 1) The computer-implemented method of claim 1, wherein performing the dump event further comprises: determining, based on a memory profile of the processing environment, whether dumping of the sensitive data is authorized. ### Claim 17 (depends on 1) The computer-implemented method of claim 1, wherein the hypervisor executes on the first processing system. ### Claim 18 (depends on 1) The computer-implemented method of claim 1, wherein the dump event is performed by a service module of the first processing system. ### Claim 19 A computer-implemented method to prevent commingling of sensitive and non-sensitive data during a dump event responsive to an operating system failure in a processing environment virtualized over a plurality of processor cores of a plurality of networked processing systems, the computer-implemented method comprising: providing, at least in part, resources virtualized over a plurality of processor cores initially designated for processing sensitive data, the plurality of processor cores including a first processor core and a second processor core, wherein the virtualized resources are assigned to a plurality of virtual machines by a hypervisor configured to execute the plurality of virtual machines; providing a memory shared by the plurality of processor cores; subsequent to processing sensitive data by the first and second processor cores, designating the second processor core as no longer being authorized to process any sensitive data, whereafter the second processor core no longer processes any sensitive data; and responsive to a failure of an operating system executing in a first of the plurality of virtual machines, the operating system having a plurality of executing applications including a first application, performing a dump event, comprising: upon determining that dumping of the sensitive data is not authorized, capturing non-sensitive data from both a second memory dedicated to the second processor core and the shared memory, while preventing capture of data from one or more portions designated as sensitive in both a first memory dedicated to the first processor core and the shared memory, in order to prevent commingling of the sensitive and non-sensitive data during the dump event when dumping of the sensitive data is not authorized. ### Claim 20 (depends on 19) The computer-implemented method of claim 19, wherein the second processor core is designated, via updating a core profile for the second processor core, as no longer being authorized to process sensitive data.