Virtual Address Sensitive Bit for Runtime Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security solutions require complete removal of intermediate data containing sensitive information or the use of metadata tags, which are inefficient and cumbersome, especially when handling sensitive data at a memory access level.
Innovation Solution
The method employs an unused bit in the virtual address space to mark sensitive data, allowing for efficient identification and protection of intermediate data generated by programs, using a neural network or AI classification model to determine similarity with original sensitive data and ensuring secure handling through a sandboxed memory environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complete removal of intermediate data is used to protect sensitive information, then data security is improved, but productivity and system efficiency deteriorate due to the need to delete and regenerate data
Solution Approach 1:
The patent changes the state parameter of data by setting a sensitive bit in the virtual address space instead of physically removing or transforming the data. This allows the same data to be protected while remaining accessible to authorized programs, eliminating the need to delete and regenerate intermediate data.
Solution Approach 2:
The system performs preliminary action by setting the sensitive bit in advance when sensitive data is identified, before any intermediate data is generated. This pre-marking allows the runtime system to automatically track and protect all derived intermediate data without requiring subsequent removal or regeneration operations.
2Difficulty of detecting and measuring
If metadata tags are used to mark sensitive data, then data identification is improved, but device complexity increases due to additional metadata management overhead
Solution Approach 1:
The patent extracts the sensitivity indicator from complex metadata structures and places it directly in the virtual address space as a single bit. This simplifies the marking mechanism while maintaining the ability to identify and track sensitive data and its intermediate derivatives throughout the system.
Solution Approach 2:
The sensitive bit in the virtual address space serves multiple functions: it marks sensitive data, enables automatic tracking of intermediate data, and provides a unified mechanism for both identification and protection. This eliminates the need for separate metadata management systems.
3Reliability
If traditional data protection methods are used, then security control is improved, but ease of operation deteriorates due to cumbersome security management procedures
Solution Approach 1:
The system implements self-service by automatically tracking and protecting intermediate data through the sensitive bit mechanism. When a program accesses marked sensitive data, the runtime system automatically identifies and marks the resulting intermediate data without requiring manual security management intervention, simplifying operations while maintaining security control.
Data Source
AI summary
A computer-implemented method, computer program product and computer system are provided. A processor receives an indication of sensitive data in one or more files. A processor updates at least one bit in the virtual address space for the one or more files indicated to have sensitive data. A processor, in response to a program accessing the one or more files, evaluates a respective virtual address for the one or more files. A processor, in response to the at least one bit in the respective virtual address for the one or more files, marks intermediate data generated by the program as sensitive data.