Protecting enterprise data at each system layer

An apparatus comprising:

• at least one processor;
• and
• a computer readable storage medium having computer readable program code embodied therewith and executable by the at least one processor, the computer readable program code comprising:
• computer readable program code that receives, on the apparatus that contains both enterprise and non-enterprise information, a request to execute a system process, wherein the enterprise and non-enterprise information is stored within a plurality of memory elements, wherein the plurality of memory elements comprise central processing unit registers, memory locations, and peripheral device registers;
• computer readable program code that thereafter, identifies, based on the request, that the system process is associated with enterprise information;
• and
• computer readable program code that grants, to a software platform and based upon the system process being associated with enterprise information, restricted access to enterprise data using a hypervisor, wherein the granting comprises granting access to the operating system kernel for performing the system process via a system call mechanism, wherein the hypervisor permits a privileged execution of a code stack;
• computer readable program code that prevents a system process associated with the non-enterprise information from gaining access to the enterprise information by:
• (i) ensuring that each component of the code stack having read access to memory elements in the enterprise data does not have write access to memory elements in the non-enterprise data and wherein a component of the code stack having write access to memory elements in the enterprise data does not have read access to memory elements in the non-enterprise data, (ii) ensuring that access to the peripheral device registers only occurs via the operating system kernel via the system call mechanism using a memory-mapped input output mechanism placed within the operating system kernel, and (iii) clearing central processing unit registers executing a user process on enterprise data upon switching a mode of execution of a central processing unit of the electronic device.

A computer program product comprising:

• a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
• computer readable program code that receives, on the apparatus that contains both enterprise and non-enterprise information, a request to execute a system process, wherein the enterprise and non-enterprise information is stored within a plurality of memory elements, wherein the plurality of memory elements comprise central processing unit registers, memory locations, and peripheral device registers;
• computer readable program code that thereafter, identifies, based on the request, that the system process is associated with enterprise information;
• and
• computer readable program code that grants, to a software platform and based upon the system process being associated with enterprise information, restricted access to enterprise data using a hypervisor, wherein the granting comprises granting access to the operating system kernel for performing the system process via a system call mechanism, wherein the hypervisor permits a privileged execution of a code stack;
• computer readable program code that prevents a system process associated with the non-enterprise information from gaining access to the enterprise information by:
• (i) ensuring that each component of the code stack having read access to memory elements in the enterprise data does not have write access to memory elements in the non-enterprise data and wherein a component of the code stack having write access to memory elements in the enterprise data does not have read access to memory elements in the non-enterprise data, (ii) ensuring that access to the peripheral device registers only occurs via the operating system kernel via the system call mechanism using a memory-mapped input output mechanism placed within the operating system kernel, and (iii) clearing central processing unit registers executing a user process on enterprise data upon switching a mode of execution of a central processing unit of the electronic device.