# US 10,503,576 B2 · Maintaining core dump privacy during application fault handling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,576 B2 - Document ID: US10503576B2 - Status: Granted - Kind: B2 - Application number: 15/047,693 - Filed: 2016-02-19 - Published: 2017-08-24 - Granted: 2019-12-10 - Earliest claimed: 2016-02-19 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Christopher N. Bailey; Paul K. Bullis - Web page: https://patentgrep.com/patent/US10503576B2 ## CPC - G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis} - G06F 11/0703: {Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 11/366: {using diagnostics (G06F11/0703 takes precedence)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Maintaining core dump privacy during application fault handling. A core memory dump is received for an application from a runtime engine. Areas of the core memory dump are analyzed to identify structural data in the form of internal structures of the runtime engine. The identified structural data is retained in a modified core memory dump, and remaining non-structural data in the areas of the core memory dump is processed to ensure it is not readable by unauthorized entities in the modified core memory dump. The modified core memory dump is outputted for fault analysis. ## Claims ### Claim 1 A computer-implemented method of maintaining core dump privacy during application fault handling, comprising: receiving, by at least one processor executing within a computing environment, a core memory dump for an application from a runtime engine; analyzing areas of the core memory dump, wherein the areas comprise an object heap, using one or more definitions of runtime structures, the one or more definitions of runtime structures including relationships between runtime structures, to identify structural data of the core memory dump in a form of runtime internal structures of the runtime engine, the structural data excluding confidential runtime application data, and wherein the analyzing areas of the core memory dump comprises: generating a map of the areas being analyzed in the core memory dump, wherein generating the map comprises: searching contents, including data structure descriptions, of the core memory dump to locate an identifier, wherein the identifier indicates an area to be mapped, and wherein the area to be mapped is part of the areas being analyzed in the core memory dump; and mapping the area to be mapped by relating, using references between data structures within the area to be mapped, one data structure being mapped to another data structure being mapped, wherein the mapping facilitates overlaying the map onto the core memory dump to identify the structural data; overlaying the map of the areas being analyzed onto the core memory dump to identify the structural data to be retained; retaining, in a modified core memory dump, the structural data to be retained, wherein the structural data to be retained are internal structures of the runtime engine that are dynamically determined during execution of the application, and wherein data of the core memory dump not identified as the structural data to be retained are identified as non-structural data; determining that a portion of the non-structural data is non-confidential and another portion of the non-structural data, remaining non-structural data, is confidential; keeping the non-structural data that is not confidential, the remaining non-structural data being removed or hidden; including the remaining non-structural data with the structural data to be retained; processing the remaining non-structural data in the areas of the core memory dump to ensure it is not readable by unauthorized entities with access to the modified core memory dump, the remaining non-structural data being data not identified as the structural data to be retained and including the confidential runtime application data, and wherein the processing the remaining non-structural data removes the remaining non-structural data from the core memory dump to result in the modified core memory dump or hides the remaining non-structural data by obfuscating or encrypting the remaining non-structural data; and outputting the modified core memory dump for fault analysis to be used to resolve a failure relating to the application executing within the computing environment, the modified core memory dump including readable structural information related to an operation of runtime. ### Claim 2 (depends on 1) The computer-implemented method as claimed in claim 1, further comprising processing the remaining non-structural data in a manner that enables an authorized user to read the remaining non-structural data. ### Claim 3 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the analyzing areas of the core memory dump comprises analyzing one or more of the following selected from a group consisting of: thread stacks, input/output buffers, and thread registers of the core memory dump. ### Claim 4 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the outputting the modified core memory dump for fault analysis transmits the modified core memory dump to a remote external analysis system. ### Claim 5 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the analyzing areas of the core memory dump comprises analyzing thread stacks. ### Claim 6 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the analyzing areas of the core memory dump to identify structural data in the form of internal structures of the runtime engine is carried out by an analysis tool for inspection of the core memory dump. ### Claim 7 A computer program product for maintaining core dump privacy during application fault handling, comprising: a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: receiving, by at least one processor executing within a computing environment, a core memory dump for an application from a runtime engine; analyzing areas of the core memory dump, wherein the areas comprise an object heap, using one or more definitions of runtime structures, the one or more definitions of runtime structures including relationships between runtime structures, to identify structural data of the core memory dump in a form of runtime internal structures of the runtime engine, the structural data excluding confidential runtime application data, and wherein the analyzing areas of the core memory dump comprises: generating a map of the areas being analyzed in the core memory dump, wherein generating the map comprises: searching contents, including data structure descriptions, of the core memory dump to locate an identifier, wherein the identifier indicates an area to be mapped, and wherein the area to be mapped is part of the areas being analyzed in the core memory dump; and mapping the area to be mapped by relating, using references between data structures within the area to be mapped, one data structure being mapped to another data structure being mapped, wherein the mapping facilitates overlaying the map onto the core memory dump to identify the structural data; overlaying the map of the areas being analyzed onto the core memory dump to identify the structural data to be retained; retaining, in a modified core memory dump, the structural data to be retained, wherein the structural data to be retained are internal structures of the runtime engine that are dynamically determined during execution of the application, and wherein data of the core memory dump not identified as the structural data to be retained are identified as non-structural data; determining that a portion of the non-structural data is non-confidential and another portion of the non-structural data, remaining non-structural data, is confidential; keeping the non-structural data that is not confidential, the remaining non-structural data being removed or hidden; including the remaining non-structural data with the structural data to be retained; processing the remaining non-structural data in the areas of the core memory dump to ensure it is not readable by unauthorized entities with access to the modified core memory dump, the remaining non-structural data being data not identified as the structural data to be retained and including the confidential runtime application data, and wherein the processing the remaining non-structural data removes the remaining non-structural data from the core memory dump to result in the modified core memory dump or hides the remaining non-structural data by obfuscating or encrypting the remaining non-structural data; and outputting the modified core memory dump for fault analysis to be used to resolve a failure relating to the application executing within the computing environment, the modified core memory dump including readable structural information related to an operation of runtime. ### Claim 8 (depends on 7) The computer program product as claimed in claim 7, wherein the analyzing areas of the core memory dump comprises analyzing one or more of the following selected from a group consisting of: thread stacks, input/output buffers, and thread registers of the core memory dump. ### Claim 9 (depends on 7) The computer program product as claimed in claim 7, wherein the outputting the modified core memory dump for fault analysis transmits the modified core memory dump to a remote external analysis system. ### Claim 10 (depends on 7) The computer program product as claimed in claim 7, wherein the analyzing areas of the core memory dump comprises analyzing thread stacks. ### Claim 11 (depends on 7) The computer program product as claimed in claim 7, wherein the method further comprises processing the remaining non-structural data in a manner that enables an authorized user to read the remaining non-structural data. ### Claim 12 (depends on 7) The computer program product as claimed in claim 7, wherein the analyzing areas of the core memory dump to identify structural data in the form of internal structures of the runtime engine is carried out by an analysis tool for inspection of the core memory dump. ### Claim 13 A computer system for maintaining core dump privacy during application fault handling, comprising: a memory; and a processor in communication with the memory, wherein the computer system is configured to perform a method, said method comprising: receiving, by at least one processor executing within a computing environment, a core memory dump for an application from a runtime engine; analyzing areas of the core memory dump, wherein the areas comprise an object heap, using one or more definitions of runtime structures, the one or more definitions of runtime structures including relationships between runtime structures, to identify structural data of the core memory dump in a form of runtime internal structures of the runtime engine, the structural data excluding confidential runtime application data, and wherein the analyzing areas of the core memory dump comprises: generating a map of the areas being analyzed in the core memory dump, wherein generating the map comprises: searching contents, including data structure descriptions, of the core memory dump to locate an identifier, wherein the identifier indicates an area to be mapped, and wherein the area to be mapped is part of the areas being analyzed in the core memory dump; and mapping the area to be mapped by relating, using references between data structures within the area to be mapped, one data structure being mapped to another data structure being mapped, wherein the mapping facilitates overlaying the map onto the core memory dump to identify the structural data; overlaying the map of the areas being analyzed onto the core memory dump to identify the structural data to be retained: retaining, in a modified core memory dump, the structural data to be retained, wherein the structural data to be retained are internal structures of the runtime engine that are dynamically determined during execution of the application, and wherein data of the core memory dump not identified as the structural data to be retained are identified as non-structural data; determining that a portion of the non-structural data is non-confidential and another portion of the non-structural data, remaining non-structural data, is confidential; keeping the non-structural data that is not confidential, the remaining non-structural data being removed or hidden; including the remaining non-structural data with the structural data to be retained; processing the remaining non-structural data in the areas of the core memory dump to ensure it is not readable by unauthorized entities with access to the modified core memory dump, the remaining non-structural data being data not identified as the structural data to be retained and including the confidential runtime application data, and wherein the processing the remaining non-structural data removes the remaining non-structural data from the core memory dump to result in the modified core memory dump or hides the remaining non-structural data by obfuscating or encrypting the remaining non-structural data; and outputting the modified core memory dump for fault analysis to be used to resolve a failure relating to the application executing within the computing environment, the modified core memory dump including readable structural information related to an operation of runtime. ### Claim 14 (depends on 13) The computer system as claimed in claim 13, wherein the analyzing areas of the core memory dump comprises analyzing one or more of the following selected from a group consisting of: thread stacks, input/output buffers, and thread registers of the core memory dump. ### Claim 15 (depends on 13) The computer system as claimed in claim 13, wherein the outputting the modified core memory dump for fault analysis transmits the modified core memory dump to a remote external analysis system. ### Claim 16 (depends on 13) The computer system as claimed in claim 13, wherein the analyzing areas of the core memory dump comprises analyzing thread stacks. ### Claim 17 (depends on 13) The computer system as claimed in claim 13, wherein the method further comprises processing the remaining non-structural data in a manner that enables an authorized user to read the remaining non-structural data.