US 2020/0050779 A1 · REDUCING COMPROMISE OF SENSITIVE DATA IN VIRTUAL MACHINE

Abstract

Techniques for reducing compromise of sensitive data in a virtual machine are described. During initiation of a secure string instance of a program module in memory allocated to the virtual machine, the program module can receive sensitive data in plaintext and retrieves parameters sourced from outside the allocated memory. During the execution of the program module, the sensitive data can be encrypted using a key based on the parameters to obtain encrypted data. The program module can overwrite the sensitive data with the encrypted data. The program module can receive a trigger to send a message that is generated using the sensitive data. The encrypted data can be decrypted using the key based on the parameters to obtain the sensitive data. After encryption and decryption, the program module can generate the message using the sensitive data and overwrite the sensitive data and the parameters used to encrypt the sensitive data.

Claims21

Dependent claims

A method comprising performing, by a computing device:

initiating a secure string instance of a program module;
receiving sensitive data at the secure string instance of the program module, the sensitive data being in plaintext;
retrieving one or more parameters that are sourced from outside of an allocated memory used for execution of the program module;
encrypting the sensitive data using the one or more parameters to obtain encrypted data;
storing the encrypted data;
receiving a trigger to send a message that is to be generated using the sensitive data;
retrieving the one or more parameters that are sourced from outside the allocated memory;
decrypting the encrypted data using the one or more parameters to obtain the sensitive data;
overwriting the one or more parameters in the allocated memory;
using the sensitive data to generate the message;
and
overwriting the sensitive data in the allocated memory so as to delete the sensitive data.

9 more elements

A computing device comprising:

a processor;
and
one or more non-transitory computer readable media storing instructions that, when executed by the processor, cause the computing device to perform:
initiating a secure string instance of a program module;
receiving sensitive data at the secure string instance of the program module, the sensitive data being in plaintext;
retrieving one or more parameters that are sourced from outside of an allocated memory used for execution of the program module;
encrypting the sensitive data using the one or more parameters to obtain encrypted data;
storing the encrypted data;
receiving a trigger to send a message that is to be generated using the sensitive data:
retrieving the one or more parameters that are sourced from outside the allocated memory;
decrypting the encrypted data using the one or more parameters to obtain the sensitive data;
overwriting the one or more parameters in the allocated memory;
using the sensitive data to generate the message;
and
overwriting the sensitive data in the allocated memory so as to delete the sensitive data.

12 more elements

Dependencies are inferred from the claim text.

Reducing compromise of sensitive data in virtual machine

Life of this patent

Reducing compromise of sensitive data in virtual machine

Life of this patent

Abstract

Claims21