Managing sensitive production data

Abstract

The present invention relates to managing sensitive production data. Production data is managed to prevent leakage of sensitive data. One or more of several techniques can be employed to discover sensitive data within production data. In one example, data about production data, specified in the form of attributes in a production application, can be used to identify sensitive data. Sensitive production data can then be masked to hide the sensitive data from view. Additionally, metadata about the sensitive data can be maintained.

Description

[0001] This invention patent application is a divisional application of the invention patent application with international application number PCT / US2014 / 067842, international application date December 1, 2014, application number 201480067158.9 entering the Chinese national phase, and titled “Managing Sensitive Production Data.” Technical Field

[0002] The present invention relates generally to the field of information technology, and more particularly to managing sensitive production data. Background Art

[0003] In production applications (such as real-world websites and web services), it is common for the production data, including the application's memory, to contain sensitive data that could compromise the user's security or integrity. Sensitive data can include, among other things, personally identifiable information (PII) that can be used to identify information about individual users. For example, a medical application might contain a doctor's notes about a patient. Similarly, an online store application might have a user's credit card number in memory.

[0004] Because production data may include sensitive data, it's undesirable to make such data accessible outside of the production environment. Furthermore, this may be required due to legal requirements and privacy agreements. However, production data is useful for diagnostics and other purposes. Consequently, if permitted, production data may be made available within the production environment. Otherwise, test data may be used in an attempt to replicate the state of a production application. Summary of the Invention

[0005] The following is a simplified summary of the invention to provide a basic understanding of some aspects of the disclosed subject matter. This summary is not an extensive overview. It is not intended to identify key / critical elements or to delineate the scope of the claimed subject matter. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.

[0006] In short, the present invention relates to managing sensitive production data. More specifically, sensitive data found in production data can be hidden from view outside the production environment. Sensitive data can be discovered in a variety of ways. According to one aspect, class fields or other program constructs in an application can be identified as locations where known sensitive data resides. Based on the designated locations, instances of sensitive data can then be discovered in the production data. Sensitive data discovered by the above or other techniques can be masked in various ways to make the sensitive data invisible. Further, metadata associated with the sensitive data can be maintained relative to the masked sensitive data.

[0007] To achieve the above and related ends, certain illustrative aspects of the claimed subject matter are described herein in conjunction with the following description and accompanying drawings. These aspects are indicative of various ways in which the subject matter may be practiced, all of which fall within the scope of the claimed subject matter. Additional advantages and novel features of the present invention will become apparent from the following detailed description when read in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a block diagram of the management system.

[0009] Figure 2 is a block diagram of representative discovery components.

[0010] Figure 3 is a block diagram of representative data analysis components.

[0011] Figure 4 is a block diagram of a representative cleaning component.

[0012] Figure 5 It is a flowchart of a method for managing production data.

[0013] Figure 6 is a flow chart of a method for discovering and masking sensitive production data.

[0014] Figure 7 is a schematic block diagram illustrating a suitable operating environment for aspects of the present disclosure. DETAILED DESCRIPTION

[0015] Applications executed in a production environment (or in other words, production applications) may operate against real-world sensitive data (as opposed to artificial test data). Occasionally, diagnostic or analytical operations are needed on a production application to solve a problem or improve performance. This may involve investigating the memory of the production application while it is operating by taking a memory snapshot and looking through the stack and / or heap to find out where the problem lies or how to improve execution. However, this memory may well include sensitive data, such as application user names, addresses, accounts, passwords, and the like. Therefore, there is a question of how to at least allow diagnostics and analysis while avoiding leaking sensitive data. Two traditional approaches attempt to avoid rather than address this problem. First, some organizations will simply not allow diagnostic or analytical operations on production data. As a result, operations have to be performed on test data, where an attempt is made to replicate the state of the production application with the test data. Second, if operations are allowed against production data, such operations are allowed separately at specific physical locations with strict security protocols (e.g., monitoring, searching).

[0016] The following details generally relate to managing production data to avoid sensitive data leakage. Production data representing the state of an application executing in a production environment may include sensitive data that should be kept confidential. Sensitive data can be discovered using a variety of techniques / mechanisms. According to one aspect, sensitive data can be discovered as a function of locations identified in a production application, such as class fields, where sensitive data is known to reside. The discovered sensitive data can be masked to hide the sensitive data from being seen outside the production environment. For example, sensitive data can be replaced with an arbitrary value, a hash of the sensitive data, or a ciphertext. However, masking alone can have adverse effects, such as for diagnosing problems or evaluating the performance of a production application. Therefore, metadata associated with the sensitive data can be maintained. For example, lengths and equations can be maintained. Thus, the sensitive data is not visible but data about the sensitive data is visible outside the production environment.

[0017] Various aspects of the present disclosure will now be described in more detail with reference to the accompanying drawings, wherein like reference numerals indicate like or corresponding elements throughout the drawings. It should be understood, however, that the drawings and their related detailed description are not intended to limit the claimed subject matter to the specific forms disclosed. On the contrary, the intention is to cover all modifications, equivalents, and alternatives that fall within the spirit and scope of the claimed subject matter.

[0018] First reference Figure 1 , shows a management system 100. Management system 100 includes a discovery component 110 and a cleansing component 120 and is configured to manage production data 130 generated by production applications 140 to prevent sensitive data leakage. Leakage is prevented by removing sensitive data from production data or otherwise preventing sensitive data sets from being introduced into production data. As a result, production data can be exposed outside the production environment because sensitive data is not visible. Furthermore, management system 100 can maintain metadata about sensitive data to facilitate analysis.

[0019] For example, production application 140 is a software application that executes in a production environment (as opposed to a pre-production development environment). In other words, the application is deployed in the real world, serving end users / customers and providing value (e.g., business value) to the end users / customers who run the application. For example, production application 140 may be a banking application or an online sales application.

[0020] Production data 130 includes data generated during the execution of a production application that represents the state of the execution at a particular instant in time when it is captured. Specifically, production data 130 may correspond to one or more memory snapshots or dumps that represent the memory state of productivity application 140 at the time the data is captured (or in other words, when the snapshot is taken or when the dump occurs). Such memory snapshots or dumps may include information about the stack, heap, loaded classes, objects, and field values, logs / traces, etc. Production data 130 may be used by a diagnostic context to debug the production application, in which case production data 130 may be referred to as a diagnostic artifact. Additionally or alternatively, production data may be used in an analysis context to analyze program performance.

[0021] Production data 130 may include sensitive data, which is production data that needs to be contained or kept confidential for one or more reasons, including meeting regulatory requirements (e.g., federal or state laws), organizational privacy policies, or user / customer configurable privacy settings. An example of sensitive data is personally identifiable information (PII), which can be any data related to a specific individual, such as an individual's name, social security number, driver's license number, account number, credit / debit card number, and account security code or password. Other non-limiting examples of sensitive data include student information and grades, and health or medical information.

[0022] The discovery component 110 and the cleansing component 120 cooperate to prevent sensitive data from being leaked or exposed to unauthorized individuals, such as those involved in diagnosing production application problems or those tasked with analyzing production application performance.

[0023] Specifically, the discovery component 110 is configured to discover or identify sensitive data, and the cleansing component 120 is configured to remove or prevent the initial injection of sensitive data identified by the discovery component 110 .

[0024] The discovery component 110 can be implemented in various ways and operate in different contexts. Figure 2 , further details a representative discovery component 110 . The discovery component 110 includes an application analysis component 210 and a data analysis component 220 .

[0025] The application analysis component 210 is configured to analyze the production application 140 and identify locations where sensitive data is known or may reside. According to one implementation, the developer may provide metadata about the nature of the sensitive data, including, for example, the specific locations of class fields where sensitive data is known to reside. Data regarding the location of sensitive data may be explicitly specified, for example, in the form of attributes associated with specific data fields. In one embodiment, the developer may annotate the production application 140 with attributes indicating which fields or other program constructs may include sensitive data. Based on this information, the locations where instances of sensitive data may reside in the production data 130 may be known. Other techniques may also be utilized to determine or infer the location of potential sensitive data based on information from the production application 140. For example, variable names, classes, functions, or methods, etc. may indicate the presence and location of sensitive data.

[0026] For clarity and easy understanding, consider the following code snippet:

[0027]

[0028]

[0029] Here, the class "Person" includes three fields, Name, Social Security Number (SSN), and Phone Number. Each field includes an attribute or annotation "SenstiveData" indicating that the field is known to contain sensitive data.

[0030] The data analysis component 220 is configured to discover specific instances of sensitive data. According to one embodiment, the data analysis component can utilize information about locations that the application analysis component 210 has determined may contain sensitive data. Of course, the production application 140 may not have been annotated with data identifying locations of potentially sensitive data, and therefore the application analysis component 210 may not be able to identify any locations of interest based on annotations or other techniques. Therefore, the data analysis component 220 can be configured to operate regardless of the results from the application analysis component 210.

[0031] Figure 3 A representative data analysis component 220 is depicted in greater detail. A search component 310 is configured to search a set of production data for sensitive data. In one embodiment, the search component 310 can search to locate sensitive data based on a pattern that captures the format or other characteristics of the sensitive data (e.g., using a regular expression or a context-free grammar). For example, a social security number includes three digits, a dash, two digits, a dash, and four digits. This defines the shape of the data corresponding to the sensitive data. For example, based on this data shape captured by a regular expression, instances of social security numbers can be located. Similar pattern matching can be used to locate phone numbers, account numbers, and the like.

[0032] Once a specific instance of sensitive data is identified through annotation, pattern matching, or other mechanisms, the search component 310 can be utilized to identify the same instance of sensitive data in other locations. For example, if a person's name is found in a specific data field, the search component 310 can search outside of the data field to locate other instances of the name. Thus, multiple passes over the production data may be required to discover the specific instance of sensitive data and other instances of the discovered sensitive data.

[0033] The subset component 320 is configured alone or in conjunction with the search component 310 to identify sensitive data that is a subset of previously discovered or identified sensitive data. For example, if a person's name (including both first and last names) is determined to be sensitive data based on code annotations or other techniques, the subset component 320 can search to identify the subset (i.e., first and last names) and locate instances of both first and last names independently of each other. Similarly, if a phone number including an area code is identified as sensitive data, the subset component 320 can attempt to locate a substring of the phone number that does not include the area code.

[0034] The variant component 330 is configured alone or in combination with the search component 310 to identify variants of sensitive data. Variants may include, but are not limited to, different formats, abbreviations, and misspellings. For example, if a social security number in the format of "123-45-6789" is identified as sensitive data through a certain mechanism, other variants, such as "123 45 6789" may also be searched for and, if located, marked as sensitive data. As another example, assume that "David Doe" is considered sensitive data. In this case, the variant component 330 may allow data instances such as "D.Doe" or "Dave Doe" to be identified as equal and sensitive data.

[0035] Database 340 can be a computer-readable storage medium that stores data, locally or remotely, as shown, for use by the various components of data analysis component 220 to locate sensitive data. In one example, database 340 can include data known to correspond to sensitive data, such as addresses, for use by search component 310. Common patterns can also be stored in database 340 for use by search component 310. As another example, database 340 can include common misspellings and abbreviations of words or names for use by variant component 330. As yet another example, database 340 can include a language dictionary that can be used to discover suitable nouns by searching against the language dictionary and marking any words that are not found to be suitable nouns.

[0036] Figure 4 Shows that it can be combined Figure 1 The management system 100 of FIG. 100 includes a representative cleaning component 120 for use with the management system 100 of FIG.

[0037] Masking component 410 is configured to remove sensitive data from production data. In one embodiment, masking component 410 is configured to replace sensitive data with other non-sensitive data. In other words, masking component 410 is configured to hide sensitive data by replacing it with non-sensitive data. In one embodiment, masking component 410 may employ a hashing algorithm on the sensitive data that contains a hash of the sensitive data. In another embodiment, an encryption algorithm may be utilized to replace the sensitive data with ciphertext. In yet another embodiment, masking component 410 may simply replace the sensitive data with an arbitrary value.

[0038] Metadata component 420 is configured to maintain metadata about sensitive data. Masking sensitive data by the method of masking component 410 removes sensitive data. However, masking alone may have adverse effects on diagnosing problems or evaluating the performance of production applications. Metadata 420 can alleviate this problem by at least maintaining data about the sensitive data hidden by the mask. Metadata may include data that is helpful in diagnosing the source of a bug or analyzing program performance. For example, the length of a data value may indicate the presence of a software error, vulnerability, or fault. Therefore, metadata component 420 can maintain the length of sensitive data (e.g., string length). As a result, helpful data is retained without exposing the sensitive data. Another non-limiting example of useful data that can be retained as metadata is a value equation. In other words, metadata can indicate whether the masked sensitive data is the same or different from other masked sensitive data.

[0039] The metadata component 420 can maintain metadata in several different ways. In one implementation, metadata can be appended (e.g., prefix, suffix) to the masked data. For example, the length of the data can be appended to the masked data. In another implementation, the metadata can be embedded or encoded within the masked data. For example, the length of the masked data can be the same as the sensitive data (e.g., variable-length hash). Similarly, identical, similar, or equivalent sensitive data can be hidden with the same mask, or in other words, replaced with a matching value. In addition, a mask for a subset of the data can be generated based on a mask for a superset of the data, and vice versa, for example, a mask for a full name can be composed of a mask for the first name and a mask for the last name. In another implementation, the metadata can be encrypted as part of a multi-layer encryption process, where a password is provided to access data about the sensitive data by partially decrypting the sensitive data but not decrypting the sensitive data itself. In yet another implementation, metadata component 420 can store metadata separately from the mask in a data source (e.g., a database, other storage stream, etc.), and can then perform a lookup on the source, for example, based on the mask value and / or memory address, to obtain the metadata. For example, metadata component 420 can be configured to write the metadata to an arbitrary buffer along with an identifier identifying the corresponding masked data. The above implementations represent a few example approaches in which metadata can be maintained. Others are possible and are considered to be within the scope of the present invention.

[0040] The following are example scenarios in which various aspects of the present invention may be employed. These scenarios are provided to aid clarity and understanding of the various aspects of the present invention and are not intended to limit the appended claims. For example, the scenarios are described in the context of diagnosis, but the disclosed aspects are not limited thereto.

[0041] Consider a scenario where a developer designs and implements a medical application. As part of this process, the developer may mask fields that could identify a patient as sensitive. Examples of such fields include name, social security number, address, phone number, etc. When a problem occurs with an application executed in a production environment, a diagnostic artifact may be produced by the production diagnostic system that includes production data. This artifact may be a full process dump or trace file, etc. For example, using a cryptographically strong hash, any data fields marked as sensitive may be masked from the diagnostic artifact. In addition, metadata about the sensitive data is retained. This ensures that important diagnostic information (such as buffer lengths and equations) is retained, but sensitive data is removed. As an example, an instance of the string "JohnDoe" is replaced with an equivalent hash of the same length as the original data "T%=1_PC$" in the diagnostic file. Thus, the equation and length remain visible, but the sensitive data is not. Alternatively, a fixed-length hash or a data index plus length may be used. Instances of sensitive data discovered need not be limited to fields marked as sensitive. Instead, all collected data can be verified for discovered sensitive data in multiple ways. This can include matches (or substrings) of any field in the heap, stack, and registers of a process dump or diagnostic trace file. In addition, subsets and variants of the sensitive data found can be identified. Hashes can be used in diagnostic files to destructively overwrite sensitive data so that it cannot be obtained by developers. Thereafter, when the developer consumes the diagnostic file, the sensitive data is obscured and therefore unavailable. For example, the name "John Doe" is not visible, but the hash and length are.

[0042] The above-described systems, architectures, environments, etc. have been described with reference to interactions between several components. It should be understood that such systems and components may include those components or subcomponents specified therein, certain specified components or subcomponents, and / or additional components. Subcomponents may also be implemented as components that are communicatively coupled to other components rather than being included in a parent component. In addition, one or more components and / or subcomponents may be combined into a single component that provides aggregation functionality. Communication between systems, components, and / or subcomponents may be implemented according to a push and / or pull model. Components may also interact with one or more other components, which are not specifically described herein for brevity, but are known to those skilled in the art.

[0043] In addition, various parts of the above disclosed systems and the following methods may include or adopt components, subcomponents, processes, devices, methods or mechanisms based on artificial intelligence, machine learning or knowledge or rules (for example, support vector machines, neural networks, expert systems, Bayesian trust networks, fuzzy logic, data fusion engines, classifiers, etc.). Such components and other components can automatically execute specific mechanisms or processes, thereby making the various parts of the systems and methods more adaptive, efficient and intelligent. As an example, but not limitation, the discovery component 110 may include a mechanism for determining or inferring sensitive data. For example, a learning mechanism can be used to identify data that may otherwise be missed.

[0044] Missed instances can exist for several reasons. First, temporary copies are created by the compiler (e.g., JIT compiler), such as registered values (which are values stored in registers rather than on the stack). A second reason is that the developer loses type information (e.g., emptying the buffer), making it impossible to easily infer the type. Another reason is that old copies of sensitive data in memory are occupied, which have been released by the application but not overwritten by the operating system. For example, stack variables for frames that have been popped are usually still in memory under the current stack pointer, and released heap values are usually not overwritten when variables are discussed or released.

[0045] Considering the exemplary system described above, referring to Figure 5 and 6 The methodologies that may be implemented in accordance with the disclosed subject matter will be better understood by referring to a flowchart of FIG. 1 . Although the methodologies are shown and described as a series of blocks for simplicity of illustration, it should be understood and appreciated that the claimed subject matter is not limited to the order of the blocks, as some blocks may be performed in a different order than depicted and described herein and / or concurrently with other blocks. Furthermore, not all of the illustrated blocks are required to implement the methodologies described below.

[0046] refer to Figure 5 , a method 500 for managing production data is shown. At reference numeral 510, sensitive data is discovered from production data. Production data represents the state of execution at a particular time when captured, and may include a process stack, a process heap, stack frame registers, and logs / traces, etc. Sensitive data can be discovered using a variety of techniques / mechanisms. For example, instances of sensitive data can be discovered in applications that are marked as including sensitive data based on class data fields. Production data can also be searched to locate known sensitive data, subsets of sensitive data, and variants of sensitive data. For example, regular expression or context-free grammar searches can be performed to locate instances of data that match a particular form or format (e.g., social security number, telephone number, etc.).

[0047] At 520, the production data is cleansed of any discovered sensitive data. The production data can be cleansed by replacing sensitive data with insensitive data. In other words, the sensitive data can be masked to conceal the sensitive data. For example, a hash algorithm can be applied to the sensitive data to generate a hash value as a mask, and the sensitive data can be replaced with the mask. Alternatively, the sensitive data can be masked by encrypting the sensitive data. Furthermore, the sensitive data can be overwritten with an arbitrary value.

[0048] At 530, metadata about the sensitive data is maintained. Metadata may include data about the sensitive data that is useful for some purposes such as diagnosis or analysis. For example, a metadata component may include the length (e.g., string length) and content identity of the sensitive data. For example, this may allow instances of the same data to be identified as identical (identity), and other fields of the data, such as length, to be used to infer the cause of the problem. Metadata can be maintained in various ways, including appending metadata to masked sensitive data, embedding metadata within masked data, or storing metadata in a storage separate from such data (e.g., a database, memory stream, etc.). As an example, a length may be appended to the masked data, or the masked data may be the same length as the sensitive data. Similarly, the same mask may be used for identical or equivalent instances of sensitive data.

[0049] Figure 6 A method 600 for discovering and masking sensitive production data is shown. At 610, instances of sensitive data are located based on code annotations or attributes that identify one or more locations (such as data fields where sensitive data is known to reside). At 620, the sensitive data is masked and metadata associated with it is determined and retained as part of the masked data or separately from the masked data. Because instances of sensitive data are not limited to the identified locations, at 620, the production data is searched for additional instances of the previously discovered sensitive data. If additional instances are found at 640 ("yes"), the method proceeds back to 620, where the instance is masked. If no additional instances are found at 640 ("no"), the method continues at 650. At 650, the production data is searched for additional sensitive data. For example, regular expressions or context-free grammars can be used to search for production data that matches a pattern of consistently sensitive data (such as, but not limited to, social security numbers and telephone numbers). Addresses can also be discovered using similar searches or through cross-correlation with mapping software. The production data may also be searched for subsets and variations of previously identified sensitive data. At reference numeral 660, a determination is made as to whether additional sensitive data is found. If so ("Yes"), the method continues at 670, where the additional sensitive data is masked and metadata is maintained. The method then loops back to reference numeral 650. If, reference numeral 660, no additional data is found ("No"), the method terminates.

[0050] As used herein, the word "exemplary" or its various forms is intended to serve as an example, instance, or illustration. Any aspect or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects or designs. Furthermore, each example is provided for clarity and understanding purposes only and is not intended to limit or restrict the claimed subject matter or the relevant portions of the present invention in any way. It will be understood that multiple additional or alternative examples of varying scope could have been presented, but have been omitted for clarity and clarity.

[0051] As used herein, the terms "component" and "system" and their various forms (e.g., component, system, subsystem, etc.) are intended to refer to a computer-related entity, which can be hardware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an instance, an executable, a thread of execution, a program, and / or a computer. By way of illustration, both an application running on a computer and the computer can be a component. One or more components can reside within a process and / or thread of execution, and a component can be localized on one computer and / or distributed between two or more computers.

[0052] As used in this description and the appended claims, the conjunction "or" is intended to mean an inclusive "or" rather than an exclusive "or," unless specified otherwise or clear from the context. For example, if "A" employs "X," "A" employs "Y," or "A" employs both "X" and "Y," then in any of the foregoing cases, "A" employs "X" or "Y" is satisfied.

[0053] Furthermore, to the extent that the terms “includes,” “comprising,” “having,” “containing,” or other variations thereof are used in the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term “comprising” as “comprising” is interpreted when used as a transitional term in the claims.

[0054] To provide context for the claimed subject matter, Figure 7 The following discussion is intended to provide a brief, general description of suitable environments in which aspects of the present subject matter can be implemented. However, the suitable environments are only examples and are not intended to suggest any limitation as to scope of use or functionality.

[0055] Although the systems and methods disclosed above can be described in the general context of computer-executable instructions for a program that can be run on one or more computers, those skilled in the art will recognize that various aspects can also be implemented in combination with other program modules, etc. Generally speaking, program modules include routines, programs, components, data structures, etc. that perform specific tasks and / or implement specific abstract data types. In addition, those skilled in the art will appreciate that the above-mentioned systems and methods can be implemented with various computer system configurations, including single-processor, multi-processor or multi-core processor computer systems, small computing devices, mainframe computers, as well as personal computers, handheld computing devices (e.g., personal digital assistants (PDAs), phones, watches), microprocessor-based or programmable consumer or industrial electronic devices, etc. Various aspects can also be implemented in a distributed computing environment where tasks are performed by remote processing devices linked through a communication network. However, some aspects of the claimed subject matter, if not all aspects, can be implemented on a stand-alone computer. In a distributed computing environment, program modules can be located in one or both of local and remote memory storage devices.

[0056] refer to Figure 7 , an example general-purpose computer or computing device 702 (e.g., a desktop, laptop, tablet, server, handheld device, programmable consumer or industrial electronics, set-top box, gaming system, computing node, etc.) is shown. The computer 702 includes one or more processors 720, memory 730, a system bus 740, mass storage 750, and one or more interface components 770. The system bus 740 is communicatively coupled to at least the aforementioned system components. However, it will be appreciated that in its simplest form, the computer 702 may include one or more processors 730 coupled to the memory 720, which execute various computer-executable actions, instructions, and / or components stored in the memory 1030.

[0057] The processor 720 may be implemented using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any processor, controller, microcontroller, or state machine. The processor(s) 720 may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, a multi-core processor, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

[0058] Computer 702 may include or otherwise interact with various computer-readable media to facilitate controlling computer 702 to implement one or more aspects of the claimed subject matter. Computer-readable media can be any available media that can be accessed by computer 702 and includes both volatile and nonvolatile media, and removable and non-removable media. Computer-readable media may include computer storage media and communication media.

[0059] Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Computer storage media includes memory devices (e.g., random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM) ...), magnetic storage devices (e.g., hard disks, floppy disks, cassettes, magnetic tapes ...), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs) ...), and solid-state devices (e.g., solid-state drives (SSDs), flash drives (e.g., cards, sticks, key drives ...) ...), or any other similar media that can be used to store (as opposed to transmit) desired information that can be accessed by computer 702. Therefore, computer storage media does not include modulated data signals.

[0060] Communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and includes any information delivery media. The term "modulated data signal" refers to a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Any combination of the above should also be included within the scope of computer-readable media.

[0061] Memory 730 and mass storage 750 are examples of computer-readable storage media. Depending on the exact configuration and type of computing device, memory 730 may be volatile (e.g., RAM), non-volatile (e.g., ROM, flash memory), or some combination of the two. For example, a basic input / output system (BIOS), which includes basic routines for transferring information between elements within computer 702, such as during startup, may be stored in non-volatile memory, while volatile memory may act as external cache memory to facilitate processing by processor 720, etc.

[0062] Mass storage 750 includes removable / non-removable, volatile / non-volatile computer storage media for storing large amounts of data relative to memory 730. For example, mass storage 750 includes, but is not limited to, one or more devices such as a magnetic or optical drive, a floppy disk drive, a flash memory, a solid-state drive, or a memory stick.

[0063] Memory 730 and mass storage 750 may include or have stored therein an operating system 760, one or more applications 762, one or more program modules 764, and data 766. Operating system 760 is used to control and allocate resources of computer 702. Applications 762 include one or both of system and application software and may utilize the management of resources by operating system 760 to perform one or more actions through program modules 764 and data 766 stored in memory 730 and / or mass storage 750. Thus, applications 762 may transform general-purpose computer 702 into a special-purpose machine based on the logic provided thereby.

[0064] All or portions of the claimed subject matter may be implemented using standard programming and / or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to implement the disclosed functionality. By way of example and not limitation, management system 100 or portions thereof may be or form part of application 762 and include one or more modules 764 and data 766 stored in memory and / or mass storage 750 whose functionality may be implemented when executed by one or more processors 720.

[0065] According to a specific embodiment, the processor(s) 720 may correspond to a system on a chip (SOC) or a similar architecture that includes or in other words integrates hardware and software on a single integrated circuit base. Here, the processor(s) 720 may include one or more processors and memories that are at least similar to the processor(s) 720 and the memory 730. Conventional processors include minimal hardware and software and rely extensively on external hardware and software. In contrast, an SOC implementation of a processor is more powerful because it embeds hardware and software therein to enable specific functions with minimal hardware and software or without relying on external hardware and software. For example, the continuous protection component 136 and / or associated functions may be embedded in the hardware in the SOC architecture.

[0066] The computer 702 also includes one or more interface components 770 that are communicatively coupled to the system bus 740 and facilitate interaction with the computer 702. By way of example, the interface component 770 can be a port (e.g., serial, parallel, PCMCIA, USB, Firewire, etc.) or an interface card (e.g., sound, video, etc.). In one example implementation, the interface component 770 can be embodied as a user input / output interface that enables a user to input commands and information into the computer 702, for example, through one or more input devices (e.g., a pointing device such as a mouse, a trackball, a stylus, a touchpad, a keyboard, a microphone, a joystick, a game pad, a satellite dish, a scanner, a camera, other computers, etc.), such as by one or more gestures or voice input. In another example implementation, the interface component 770 can be embodied as an output peripheral interface that provides output to a display (e.g., LCD, LED, plasma, etc.), a speaker, a printer, and / or another computer, etc. Furthermore, interface component 770 may be embodied as a network interface that enables communication with other computing devices (not shown), such as through a wired or wireless communication link.

[0067] What has been described above includes examples of various aspects of the claimed subject matter. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the claimed subject matter, but one skilled in the art will recognize that many further combinations and permutations of the claimed subject matter are possible. Thus, the disclosed subject matter is intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. A computer-implemented method for managing sensitive data, comprising: generating production data by a production application executed in a production environment, the production data corresponding to one or more memory snapshots or dumps representing a memory state of the production application at a particular moment in time; identifying, by a first executed component, one or more locations of instances of sensitive production data in the production application based on code annotations, wherein the code annotations include metadata in the production application, the metadata explicitly indicating a data field including sensitive data; Searching, by the first executed component, production data generated by the production application to find another instance of the sensitive production data; generating, by the first executed component, a mask for hiding the sensitive production data for the sensitive production data; maintaining metadata about said sensitive production data; as well as The first executed component masks the instance of the sensitive production data whose location has been identified and other instances of the sensitive production data found by the search by replacing the sensitive production data with the mask.

2. The method according to claim 1, wherein Maintaining the metadata includes appending the metadata to the mask.

3. The method according to claim 1, wherein Maintaining the metadata includes encoding the metadata within the mask.

4. The method according to claim 1, wherein Maintaining the metadata includes storing the metadata separately from the mask.

5. The method according to claim 1, wherein Maintaining the metadata includes capturing the length of the sensitive production data.

6. A system for managing sensitive data, comprising: a first component configured to discover instances of sensitive production data in production data generated by a production application based on one or more code annotations specified within the production application, wherein the code annotations include metadata in the production application that explicitly indicates data fields that include sensitive data, and the first component is configured to search the production data generated by the production application for additional instances of the discovered sensitive production data; wherein the production application is executed in a production environment, and the production data corresponds to one or more memory snapshots or dumps representing a memory state of the production application at a particular moment in time; and The first component is further configured to: generating a mask for the sensitive production data for hiding the sensitive production data; maintaining metadata about the sensitive production data; and The discovered instance of the sensitive production data and other instances of the sensitive production data found by the search are masked by replacing the sensitive production data with the mask.

7. The system according to claim 6, wherein: Also included is a second component configured to discover the sensitive production data based on a pattern describing the sensitive data.

8. The system according to claim 6, wherein: Also included is a second component configured to discover a subset of the previously discovered sensitive production data.

9. The system according to claim 6, wherein: The sensitive production data includes at least a portion of a diagnostic artifact.

Images