A computer system for providing perfect forward secrecy in a virtual machine, the system comprising: a data processing component; a physical memory; and local data storage having stored thereon computer executable program code, which when executed by the data processing component causes the data processing component to: receive, from an application (121, 122, 123) operating within a virtual machine, a secure memory allocation function for a connection secret, wherein the secure memory allocation function includes a memory size parameter; and allocate memory for the connection secret according to the memory size parameter, wherein the memory includes a memory location and a memory size; characterized in that the computer executable code, when executed by the data processing component, causes the data processing component to: transmit the memory location and the memory size to a virtual machine host to be stored as an entry in a secure database; store the entry in the secure database; monitor an operation state relating to the virtual machine; receive a notice indicating a change to the operation state of the virtual machine; determine the operation state of the virtual machine; retrieve the entry from the secure database relating to the virtual machine; and sanitize, based on the operation state of the virtual machine, the memory location indicated by the entry. a data processing component; a physical memory; and local data storage having stored thereon computer executable program code, which when executed by the data processing component causes the data processing component to: receive, from an application (121, 122, 123) operating within a virtual machine, a secure memory allocation function for a connection secret, wherein the secure memory allocation function includes a memory size parameter; and allocate memory for the connection secret according to the memory size parameter, wherein the memory includes a memory location and a memory size; characterized in that the computer executable code, when executed by the data processing component, causes the data processing component to: transmit the memory location and the memory size to a virtual machine host to be stored as an entry in a secure database; store the entry in the secure database; monitor an operation state relating to the virtual machine; receive a notice indicating a change to the operation state of the virtual machine; determine the operation state of the virtual machine; retrieve the entry from the secure database relating to the virtual machine; and sanitize, based on the operation state of the virtual machine, the memory location indicated by the entry. receive, from an application (121, 122, 123) operating within a virtual machine, a secure memory allocation function for a connection secret, wherein the secure memory allocation function includes a memory size parameter; and allocate memory for the connection secret according to the memory size parameter, wherein the memory includes a memory location and a memory size; characterized in that the computer executable code, when executed by the data processing component, causes the data processing component to: transmit the memory location and the memory size to a virtual machine host to be stored as an entry in a secure database; store the entry in the secure database; monitor an operation state relating to the virtual machine; receive a notice indicating a change to the operation state of the virtual machine; determine the operation state of the virtual machine; retrieve the entry from the secure database relating to the virtual machine; and sanitize, based on the operation state of the virtual machine, the memory location indicated by the entry. transmit the memory location and the memory size to a virtual machine host to be stored as an entry in a secure database; store the entry in the secure database; monitor an operation state relating to the virtual machine; receive a notice indicating a change to the operation state of the virtual machine; determine the operation state of the virtual machine; retrieve the entry from the secure database relating to the virtual machine; and sanitize, based on the operation state of the virtual machine, the memory location indicated by the entry.