Protection of sensitive data
Particular embodiments described herein provide for an electronic device that can be configured to monitor access to data in a secured area of memory at a hypervisor level, receive a request from a process to the data in the secured area, and deny the request if the process is not a trusted process. In an example, the electronic device is a point of sale device.
1. At least one non-transitory machine readable medium comprising one or more instructions that when executed by at least one processor of an electronic device, cause the at least one processor to:
receive data via a network;
determine if the data includes sensitive information;
store the data in a secured area of memory if the data includes sensitive information;
monitor, by a security module, access to the data in the secured area of memory, wherein the secured area of memory is at a hypervisor level;
receive a request from an application to access the data in the secured area;
determine if the application is a trusted application; and
allow the request if the application is a trusted application; or
deny the request if the application is not a trusted application; and
wherein the one or more instructions further cause the at least one processor to store the data in a non-secured area of memory if the data does not include sensitive information.
2. The at least one non-transitory machine readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:
set a permission to read the data in the secured area of memory to a deny permission.
3. The at least one non-transitory machine readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:
allow the request if the application is included in a whitelist.
4. The at least one non-transitory machine readable medium of claim 1 , wherein the electronic device is a point of sale device.
5. An electronic device comprising:
memory; and
a hardware processor configured to execute a security module configured to:
receive data via a network;
determine if the data includes sensitive information;
store the data in a secured area of memory if the data includes sensitive information;
monitor access to data in a secured area of the memory, wherein the secured area of memory is at a hypervisor level;
receive a request from an application to access the data in the secured area;
determine if the application is a trusted application; and
allow the request if the application is a trusted application; or
deny the request if the application is not a trusted application; and
wherein the hardware processor is further configured to store the data in a non-secured area of memory if the data does not include sensitive information.
6. The apparatus of claim 5 , wherein the security module is further configured to:
set a permission to read the data in the secured area of the memory to a deny permission.
7. The apparatus of claim 5 wherein the security module is further configured to:
allow the request if the application is included in a whitelist.
8. The apparatus of claim 5 , wherein the electronic device is a point of sale device.
9. A method comprising:
receiving, with a hardware processor of an electronic device, data via a network;
determining, with the hardware processor, if the data includes sensitive information;
storing, with the hardware processor, the data in a secured area of memory if the data includes sensitive information;
monitoring, with the hardware processor, access to data in a secured area of memory, wherein the secured area of memory is at a hypervisor level;
receiving, with the hardware processor, a request from an application to access the data in the secured area;
determining, with the hardware processor, if the application is a trusted application; and
allowing, with the hardware processor, the request if the application is a trusted application; or
denying, with the hardware processor, the request if the application is not a trusted application; and
wherein the hardware processor is further configured to store the data in a non-secured area of memory if the data does not include sensitive information.
10. The method of claim 9 , further comprising:
setting a permission to read the data in the secured area of memory to a deny permission.
11. The method of claim 9 , further comprising:
allowing, with the hardware processor, the request if the application is included in a whitelist.
12. The method of claim 9 , wherein the electronic device is a point of sale device.
13. A system for protecting data, the system comprising:
memory in an electronic device;
a hardware processor in the electronic device, wherein the processor is configured to execute a security module configured to:
receive data via a network;
determine if the data includes sensitive information;
store the data in a secured area of memory if the data includes sensitive information;
monitor access to data in a secured area of the memory, wherein the secured area of memory is at a hypervisor level;
receive a request from an application to access the data in the secured area;
determine if the application is a trusted application; and
allow the request if the application is a trusted application; or
deny the request if the application is not a trusted application; and
wherein the hardware processor is further configured to store the data in a non-secured area of memory if the data does not include sensitive information.
14. The system of claim 13 , wherein the system is further configured to:
set a permission to read the data in the secured area of the memory to a deny permission.
15. The system of claim 13 , wherein the system is further configured to:
allow the request if the application is included in a whitelist.
16. The system of claim 13 , wherein the electronic device is a point of sale device.