Memory tagging for sensitive data redaction in memory dump

Examples of techniques for memory tagging for sensitive data redaction in a memory dump are described herein. An aspect includes receiving a first call to a memory tagging application programming interface (API) from an application, wherein the first call designates a virtual memory page belonging to the application as containing sensitive data. Another aspect includes, based on the first call to the memory tagging API, tagging a physical memory page corresponding to the virtual memory page as sensitive.

BACKGROUND

The present invention generally relates to computer systems, and more specifically, to memory tagging for sensitive data redaction in a memory dump in a computer system.

Computer systems may store relatively large amounts of personal user data. Many types of websites (for example, banks, retailers, and social media) may collect and store potentially sensitive personal user data, including but not limited to names, addresses, credit card numbers, social security numbers, and personal health information on a computer system. If sensitive or otherwise protected (e.g., by data privacy regulations) user data falls into the wrong hands, legal repercussions, fraud, identify theft, or similar harm may occur. A security breach may also result in a loss of consumer trust in an organization.

SUMMARY

According to an embodiment described herein, a system can include a processor to receive a first call to a memory tagging application programming interface (API) from an application, wherein the first call designates a virtual memory page belonging to the application as containing sensitive data. The processor can also, based on the first call to the memory tagging API, tag a physical memory page corresponding to the virtual memory page as sensitive.

According to another embodiment described herein, a method can include receiving, by a processor, a first call to a memory tagging application programming interface (API) from an application, wherein the first call designates a virtual memory page belonging to the application as containing sensitive data. The method can also include, based on the first call to the memory tagging API, tagging, by the processor, a physical memory page corresponding to the virtual memory page as sensitive.

According to another embodiment described herein a computer program product may include computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method including receive a first call to a memory tagging application programming interface (API) from an application, wherein the first call designates a virtual memory page belonging to the application as containing sensitive data. The method can also include, based on the first call to the memory tagging API, tagging a physical memory page corresponding to the virtual memory page as sensitive.

DETAILED DESCRIPTION

One or more embodiments of the present invention provide memory tagging for sensitive data redaction in a memory dump. An operating system (OS) of a computer system may generate memory dumps in response to errors. A memory dump causes the contents of a memory region to be displayed and/or stored in case of an application or system crash. The contents of the memory dump may help software developers and system administrators to diagnose, identify, and resolve a problem that caused an application or system failure. When capturing a memory dump, a dumping module gathers data to include in the dump based on options specified by the invoking program. Memory tagging allows an application to tag any virtual memory pages that contain sensitive data. The dumping module may then determine whether any data in an address space that is targeted for a memory dump is sensitive based on the memory tagging, and may redact any sensitive data in the dump.

Memory tagging may be performed via calls from an application to an application programming interface (API). The API may be supported by an OS that enables execution of the application. Calls to the API may be included in the source code of a software application by, for example, a computer programmer. A virtual memory page that is allocated to the application may be tagged as sensitive at the time of allocation. A virtual memory page may also be tagged as sensitive after allocation, and may be untagged and/or retagged as sensitive during execution of the application through subsequent API calls from the application. Using the memory tagging API, an application can identify any virtual memory pages where sensitive data will reside either at memory allocation time, or later, when the sensitive data is copied to a memory location. Based on memory locations having been identified as containing sensitive data via tagging, a post processor of the OS may redact (e.g., remove or encrypt) the data from tagged memory locations in a memory dump that includes any tagged memory locations. The redaction may prevent unauthorized personnel from gaining access to sensitive, confidential, or otherwise protected information via a memory dump.

As shown inFIG. 1, the computer system100has one or more central processing units (CPU(s))101a,101b,101c, etc. (collectively or generically referred to as processor(s)101). The processors101can be a single-core processor, multi-core processor, computing cluster, or any number of other configurations. The processors101, also referred to as processing circuits, are coupled via a system bus102to a system memory103and various other components. The system memory103can include a read only memory (ROM)104and a random access memory (RAM)105. The ROM104is coupled to the system bus102and may include a basic input/output system (BIOS), which controls certain basic functions of the computer system100. The RAM is read-write memory coupled to the system bus102for use by the processors101. The system memory103provides temporary memory space for operations of said instructions during operation. The system memory103can include random access memory (RAM), read only memory, flash memory, or any other suitable memory systems.

The computer system100comprises an input/output (I/O) adapter106and a communications adapter107coupled to the system bus102. The I/O adapter106may be a small computer system interface (SCSI) adapter that communicates with a hard disk108and/or any other similar component. The I/O adapter106and the hard disk108are collectively referred to herein as a mass storage110.

Software111for execution on the computer system100may be stored in the mass storage110. The mass storage110is an example of a tangible storage medium readable by the processors101, where the software111is stored as instructions for execution by the processors101to cause the computer system100to operate, such as is described herein below with respect to the various Figures. Examples of computer program product and the execution of such instruction is discussed herein in more detail. The communications adapter107interconnects the system bus102with a network112, which may be an outside network, enabling the computer system100to communicate with other such systems. In one embodiment, a portion of the system memory103and the mass storage110collectively store an operating system, which may be any appropriate operating system, such as the z/OS or AIX operating system from IBM Corporation, to coordinate the functions of the various components shown inFIG. 1.

Additional input/output devices are shown as connected to the system bus102via a display adapter115and an interface adapter116and. In one embodiment, the adapters106,107,115, and116may be connected to one or more I/O buses that are connected to the system bus102via an intermediate bus bridge (not shown). A display119(e.g., a screen or a display monitor) is connected to the system bus102by a display adapter115, which may include a graphics controller to improve the performance of graphics intensive applications and a video controller. A keyboard121, a mouse122, a speaker123, etc. can be interconnected to the system bus102via the interface adapter116, which may include, for example, a Super I/O chip integrating multiple device adapters into a single integrated circuit. Suitable I/O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Thus, as configured inFIG. 1, the computer system100includes processing capability in the form of the processors101, and, storage capability including the system memory103and the mass storage110, input means such as the keyboard121and the mouse122, and output capability including the speaker123and the display119.

In some embodiments, the communications adapter107can transmit data using any suitable interface or protocol, such as the internet small computer system interface, among others. The network112may be a cellular network, a radio network, a wide area network (WAN), a local area network (LAN), or the Internet, among others. An external computing device may connect to the computing system100through the network112. In some examples, an external computing device may be an external webserver or a cloud computing node.

It is to be understood that the block diagram ofFIG. 1is not intended to indicate that the computer system100is to include all of the components shown inFIG. 1. Rather, the computer system100can include any appropriate fewer or additional components not illustrated inFIG. 1(e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.). Further, the embodiments described herein with respect to computer system100may be implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments.

FIG. 2is a process flow diagram of a method200for memory tagging for sensitive data redaction in a memory dump in accordance with one or more embodiments of the present invention. The method200can be implemented with any suitable computing device, such as the computer system100ofFIG. 1. In block201ofFIG. 2, an application, which may be part of software111ofFIG. 1, issues a call to a memory tagging API to tag a virtual memory page that is allocated to the application as containing sensitive data. The virtual memory page may be a subset of a block of virtual memory that is allocated to the application. The API call of block201may occur at the time of allocation of the virtual memory page in some embodiments; in other embodiments, the API call of block201may occur after allocation during the execution of the application. In block202, the physical memory page corresponding to the virtual memory page is tagged as sensitive based on the API call of block201. A sensitivity identifier may be included within the physical memory page in some embodiments. In block203, as execution of the application continues, the application may call the memory tagging API to change the sensitivity tagging of any virtual memory page that is allocated to the application (i.e., to tag or untag the page as sensitive), and, in block204, the physical memory page corresponding to the change call to the memory tagging API of block203is tagged or untagged as sensitive. Blocks203and204of method200ofFIG. 2may be repeated any appropriate number of times during the execution of an application. An application may be allocated any appropriate number and size of memory pages as part of a virtual address space. Any appropriate subset of the address space may be tagged and/or untagged as sensitive during execution of the application as described with respect to method200ofFIG. 2, based on the memory tagging API calls that are included in the application. Multiple applications in a computer system may simultaneously implement method200ofFIG. 2in their respective address spaces during execution.FIG. 2is discussed in further detail below with respect toFIG. 4.

Embodiments of a memory tagging API that operates according to embodiments of method200ofFIG. 2may be included in any appropriate OS, including but not limited to z/OS. A storage manager component in the OS may provide services to allocate virtual storage for programs. In some embodiments, the memory allocation services may accept a sensitivity keyword, e.g., SENSITIVE, to identify that the contents of an allocated memory location are sensitive. For example, specification of a SENSITIVE(Yes) keyword may tag a memory location as sensitive. A sensitivity keyword may be implemented in any appropriate OS memory allocation services. For example, various z/OS services, including but not limited to IARV64 (GETCOMMON, GETSTOR and GETSHARED); IARCP64 and IARST64; STORAGE OBTAIN; and CPOOL BUILD may accept a sensitivity keyword in calls to the services, as described above. Embodiments of a sensitivity keyword may be implemented in blocks201and202ofFIG. 2.

While, in some embodiments, an application may choose to identify a memory object as sensitive at allocation time using a sensitivity keyword, the sensitivity of a memory object may not necessarily be known at the time of storage allocation. In some embodiments, tagging functionality may be included via a memory tagging API in subsequent memory allocation services via a change sensitivity keyword (e.g., CHANGEDATATYPE). For example, various z/OS services may accept a change sensitivity keyword, including but not limited to IARV64 and PGSER. For example, an application may use a change sensitivity keyword such as REQUEST=CHANGEDATATYPE SENSITIVE(YES) along with a memory address to mark a memory object as sensitive at any time after the memory object has been created. Embodiments of a change sensitivity keyword may be implemented in blocks203and204ofFIG. 2.

The process flow diagram ofFIG. 2is not intended to indicate that the operations of the method200are to be executed in any particular order, or that all of the operations of the method200are to be included in every case. Additionally, the method200can include any suitable number of additional operations.

FIG. 3is a process flow diagram of a method300for sensitive data redaction in a memory dump in accordance with one or more embodiments of the present invention. The method300can be implemented with any suitable computing device, such as the computer system100ofFIG. 1. In block301, a dump of a virtual address space is triggered by, for example, an error in the computer system. The dump may be triggered in block301during execution of an application that is using the address space that targeted for the dump. In block302, the data from the targeted address space is provided as a primary dump to a dumping module comprising a post processor. In block303, the post processor determines whether any of the virtual memory pages in the virtual address space that is targeted for the dump are currently tagged as sensitive based on memory tagging that was performed as discussed above with respect to method200FIG. 2. In block304, the post processor redacts (e.g., removes or encrypts) from the dump any data corresponding to any virtual address page that was determined to be tagged as sensitive in block303. In block305, the post processor outputs a redacted dump that does not include the sensitive data. Method300ofFIG. 3may be triggered whenever a memory dump is triggered in a computer system, at any time during execution of method200ofFIG. 2.FIG. 3is discussed below in further detail with respect toFIG. 5.

Method300ofFIG. 3may be implemented in conjunction with any appropriate OS. In embodiments ofFIG. 3that are included in a z/OS system, a post processor that receives the data that is being dumped as described with respect to block302may be part of a first failure data capture (FFDC) module. In some embodiments, post processing may be invoked via an interactive problem control system (IPCS) which may redact the tagged pages and create the secondary dump.

The process flow diagram ofFIG. 3is not intended to indicate that the operations of the method300are to be executed in any particular order, or that all of the operations of the method300are to be included in every case. Additionally, the method300can include any suitable number of additional operations.

FIG. 4is a block diagram of a system400that includes memory tagging for sensitive data redaction in a memory dump in accordance with one or more embodiments of the present invention. System400includes an application401that is running on a computer system (e.g., computer system100ofFIG. 1, as part of software111). System400further includes a memory tagging API402that may be part of an OS of the computer system. The memory tagging API402may include commands to tag and untag designated memory pages, such as memory pages406A-C,407A-N, and408A-N, as sensitive. A virtual address space403may be allocated to the application401. The virtual address space403includes a plurality of virtual memory pages406A-C that are currently tagged as sensitive. The virtual address space403also includes a plurality of virtual memory pages that are not tagged as sensitive. Central storage404includes a plurality of memory pages407A-N that are tagged as sensitive by memory tagging API402. Central Storage404also includes a plurality of memory pages that are not tagged as sensitive. Disk storage405includes a plurality of memory pages408A-N that are tagged as sensitive by memory tagging API402. Disk storage405also includes a plurality of memory pages that are not tagged as sensitive. Sensitive memory pages406A-C,407A-D, and408A-C are each tagged via calls to memory tagging API402by an application such as application401; the sensitivity tagging may be performed according to method200ofFIG. 2.

It is to be understood that the block diagram ofFIG. 4is not intended to indicate that the computer system400is to include all of the components shown inFIG. 4. Rather, the computer system400can include any appropriate fewer or additional components not illustrated inFIG. 4(e.g., additional memory components, applications, virtual address spaces, tagged and/or untagged memory pages, etc.). Further, the embodiments described herein with respect to computer system400may be implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments.

FIG. 5is a block diagram of a system500for sensitive data redaction in a memory dump in accordance with one or more embodiments of the present invention. System500includes a primary dump501of a virtual address space that is targeted for a memory dump, as described above with respect to method300ofFIG. 3. The primary dump501may include all data corresponding to a virtual address space such as virtual address space403ofFIG. 4. The primary dump501includes sensitive data that is located in tagged virtual memory pages, i.e., sensitive data502A-N. Sensitive data502A-N may be located in memory pages that were tagged as sensitive according to method200ofFIG. 2. The primary dump501is provided to a post processor503of a computer system (e.g., computer system100ofFIG. 1, as part of software111). The post processor503identifies the data that is tagged as sensitive and redacts the identified data. The redacted data may be removed or encrypted in various embodiments. The post processor503then outputs a redacted dump504of the virtual address space, with the data corresponding to sensitive data502A-N removed or encrypted. The redacted dump504may prevent unauthorized personnel from gaining access to sensitive, confidential, or otherwise protected information that would be available in primary dump501.

It is to be understood that the block diagram ofFIG. 5is not intended to indicate that the computer system500is to include all of the components shown inFIG. 5. Rather, the computer system500can include any appropriate fewer or additional components not illustrated inFIG. 5(e.g., additional dumps, modules, tagged or untagged memory pages, etc.). Further, the embodiments described herein with respect to computer system500may be implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments.