Selective Memory Clearing for Sensitive Application Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems face challenges in effectively protecting sensitive data from unauthorized access through side channel attacks, leading to potential data breaches and increased system performance overheads due to inefficient memory clearing methods.
Innovation Solution
An operating system component selectively clears sensitive data from memory based on sensitivity information embedded in application metadata, using a memory manager to determine and clear data portions before process termination or switching, reducing the risk of data exposure and optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent memory clearing operations are performed to prevent side channel attacks, then data security is improved, but system performance overhead increases
Solution Approach 1:
The patent applies local quality by selectively clearing only the memory regions that contain sensitive data rather than clearing the entire memory space. The system identifies sensitive data locations through metadata tags associated with specific memory regions, and only those regions are cleared when process termination or context switching occurs. This targeted approach maintains security while significantly reducing the performance overhead compared to full memory clearing operations.
Solution Approach 2:
The patent segments the memory space into different regions based on data sensitivity. Each memory region is tagged with metadata indicating whether it contains sensitive data requiring clearance. This segmentation allows the memory manager to distinguish between sensitive and non-sensitive regions, applying clearance operations only where necessary. The segmentation principle enables efficient selective clearing that balances security requirements with system performance.
2Reliability
If comprehensive memory clearing is performed for all data, then data protection is improved, but maintenance costs and system overhead increase
Solution Approach 1:
The system implements local quality by differentiating between memory regions based on their sensitivity characteristics. Metadata tags are attached to specific memory regions to indicate whether they contain sensitive data. The memory manager uses this information to apply appropriate clearance operations only to sensitive regions, avoiding unnecessary operations on non-sensitive data and reducing overall system overhead.
Solution Approach 2:
The patent implements self-service by enabling applications to self-identify and self-manage their sensitive data requirements through metadata tags. Applications mark their own memory regions with appropriate sensitivity indicators, and the memory manager automatically uses these tags to determine clearance requirements. This eliminates the need for centralized manual configuration and reduces system management complexity.
Data Source
AI summary
Examples disclosed herein relate to protecting sensitive data. An application program is loaded on to memory of a computing device. The application program includes application code and sensitivity information. The sensitivity information is detected to determine application sensitivity. In response to the determination of the application sensitivity, a data portion corresponding to the application program is cleared from the memory before loading another application program.


