Protecting sensitive data in software products and in generating core dumps

1. A method of protecting sensitive data in a software product, said method comprising:

compiling, by a processor, a source file of the software product to generate an object file, wherein the source file includes at least one piece of sensitive data marked with a specific identifier, and the object file has a secure data section for saving storage information of the at least one piece of sensitive data at compile-time and run-time;

linking, by the processor, the object file to generate an executable file, wherein the executable file is to update the secure data section at run-time; and

updating the secure data section at run-time, to include storage information of the sensitive data, wherein the storage information can be utilized to locate and acquire the sensitive data corresponding to the storage information.

2. The method according to claim 1 , wherein the updating of the secure data section includes updating a memory address and an address offset of the at least one piece of sensitive data in the secure data section.

3. The method according to claim 2 , wherein the secure data section includes a header and a record section, wherein a pointer to the secure data section is saved in a file header of the object file, and the header includes an identifier of the secure data section, an amount of the storage information recorded in the record section and a back pointer to the file header.

4. The method according to claim 1 , wherein the compiling of the source file of the software product to generate the object file includes:

identifying the at least one piece of sensitive data from the source file based on the specific identifier;

setting up the secure data section;

recording storage information of static sensitive data pertaining to a static variable in the at least one piece of sensitive data into the secure data section, as a static storage record;

generating a machine instruction, the machine instruction to record storage information of dynamic sensitive data pertaining to a dynamic variable in the at least one piece of sensitive data into the secure data section as a dynamic storage record; and

generating the object file having the secure data section.

5. The method according to claim 4 , wherein the compiling of the source file of the software product to generate the object file further includes generating a machine instruction for removing corresponding dynamic storage records when the dynamic sensitive data is released.

6. The method according to claim 4 , wherein the compiling of the source file of the software product to generate the object file further includes generating a relocation record for relocating addresses of the static storage record and the dynamic storage record in the secure data section based on linking a plurality of object files.

7. The method according to claim 1 , wherein the linking of the object file to generate an executable file includes:

determining whether there is a plurality of object files;

merging the plurality of object files to provide a merged object file, based on determining there is the plurality of object files;

relocating a new secure data section in the merged object file; and

generating an executable file having the new secure data section.

8. A system comprising:

a memory;

a processor in communication with the memory; and

program instructions executable by the processor via the memory to perform a method, the method comprising:

compiling, by the processor, a source file of the software product to generate an object file, wherein the source file includes at least one piece of sensitive data marked with a specific identifier, and the object file has a secure data section for saving storage information of the at least one piece of sensitive data at compile-time and run-time;

linking, by the processor, the object file to generate an executable file, the executable file to update the secure data section at run-time; and

updating, by the processor, the secure data section at run-time, to include storage information of the sensitive data, wherein the storage information can be utilized to locate and acquire the sensitive data corresponding to the storage information.

9. The system according to claim 8 , wherein the compiling includes:

identifying, by the processor, the at least one piece of sensitive data from the source file based on the specific identifier;

setting up, by the processor, the secure data section;

recording, by the processor, storage information of static sensitive data pertaining to a static variable in the at least one piece of sensitive data into the secure data section, as a static storage record;

generating, by the processor, a machine instruction, wherein the machine instruction records storage information of dynamic sensitive data pertaining to a dynamic variable in the at least one piece of sensitive data into the secure data section as a dynamic storage record; and

generating, by the processor, the object file having the secure data section.

10. The system according to claim 9 , wherein generating the machine instruction further comprises generating a machine instruction for removing corresponding dynamic storage records when the dynamic sensitive data is released.

11. The system according to claim 9 , wherein the compiler further includes a relocation record generation module configured to generate a relocation record for relocating addresses of the static storage record and the dynamic storage record in the secure data section based on linking a plurality of object files.

12. The system according to claim 8 , wherein the secure data section includes a header and a record section, wherein a pointer to the secure data section is saved in a file header of the object file, and wherein the header includes an identifier of the secure data section, an amount of the storage information recorded in the record section and a back pointer to the file header.

13. The system according to claim 8 , wherein the linking includes:

determining, by the processor, whether there is a plurality of object files;

merging, by the processor, the plurality of object files to provide a merged object file, based on determining there is the plurality of object files;

relocating, by the processor, a new secure data section in the merged object file; and

generating, by the processor, an executable file having the new secure data section.