Selective Memory Clearing for Sensitive Application Data

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing operating systems face challenges in effectively protecting sensitive data from unauthorized access through side channel attacks, leading to potential data breaches and increased system performance overheads due to inefficient memory clearing methods.

Innovation Solution

An operating system component selectively clears sensitive data from memory based on sensitivity information embedded in application metadata, using a memory manager to determine and clear data portions before process termination or switching, reducing the risk of data exposure and optimizing resource usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If frequent memory clearing operations are performed to prevent side channel attacks, then data security is improved, but system performance overhead increases

Engineering Contradiction:
Improvedata securityVSAvoidsystem performance
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by selectively clearing only the memory regions that contain sensitive data rather than clearing the entire memory space. The system identifies sensitive data locations through metadata tags associated with specific memory regions, and only those regions are cleared when process termination or context switching occurs. This targeted approach maintains security while significantly reducing the performance overhead compared to full memory clearing operations.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The patent segments the memory space into different regions based on data sensitivity. Each memory region is tagged with metadata indicating whether it contains sensitive data requiring clearance. This segmentation allows the memory manager to distinguish between sensitive and non-sensitive regions, applying clearance operations only where necessary. The segmentation principle enables efficient selective clearing that balances security requirements with system performance.

Inventive Principle:
Principle #1Segmentation

2Reliability

If comprehensive memory clearing is performed for all data, then data protection is improved, but maintenance costs and system overhead increase

Engineering Contradiction:
Improvedata protectionVSAvoidsystem overhead
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system implements local quality by differentiating between memory regions based on their sensitivity characteristics. Metadata tags are attached to specific memory regions to indicate whether they contain sensitive data. The memory manager uses this information to apply appropriate clearance operations only to sensitive regions, avoiding unnecessary operations on non-sensitive data and reducing overall system overhead.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The patent implements self-service by enabling applications to self-identify and self-manage their sensitive data requirements through metadata tags. Applications mark their own memory regions with appropriate sensitivity indicators, and the memory manager automatically uses these tags to determine clearance requirements. This eliminates the need for centralized manual configuration and reduces system management complexity.

Inventive Principle:
Principle #25Self-service

Data Source

PatentUS12530491B2Selective deletion of sensitive data
Publication Date: 2026.01.20 HEWLETT PACKARD ENTERPRISE DEV LP
  • US12530491B2 patent drawing
  • US12530491B2 patent drawing
  • US12530491B2 patent drawing

AI summary

Examples disclosed herein relate to protecting sensitive data. An application program is loaded on to memory of a computing device. The application program includes application code and sensitivity information. The sensitivity information is detected to determine application sensitivity. In response to the determination of the application sensitivity, a data portion corresponding to the application program is cleared from the memory before loading another application program.