Smart data protection

Abstract

When a system receives sensitive data, it can request an encryption key from an encryption/decryption unit. A central processing unit (CPU) of the system can encrypt the sensitive data using the encryption key before writing the sensitive data to memory. Thus, the sensitive data is encrypted when written to memory.

What is claimed is: 
     
         1 . A method, comprising:
 receiving by a processor unencrypted sensitive data with instructions compiled from application source code to encrypt the sensitive data for writing to a live memory, the live memory including unencrypted nonsensitive data;   requesting an encryption key from a key manager;   receiving the encryption key, the encryption key associated with the sensitive data;   preventing an unencrypted form of the sensitive data from being stored in the live memory, wherein the preventing includes:   encrypting the sensitive data using the encryption key; and   writing the encrypted sensitive data to the live memory.   
     
     
         2 . The method of  claim 1 , further comprising:
 retrieving the encrypted sensitive data from the live memory;   requesting a decryption key from the key manager, the decryption key associated with the sensitive data of the particular data type;   receiving the decryption key; and   decrypting the encrypted sensitive data using the decryption key.   
     
     
         3 . The method of  claim 1 , wherein the receiving sensitive data comprises:
 receiving data, the data including one or more tags comprising sensitive data type information; and   determining, based on the one or more tags, that the data comprises sensitive data.   
     
     
         4 . The method of  claim 3 , further comprising:
 determining, based on the one or more tags, a sensitive data type of the sensitive data; and   wherein:   the requesting comprises sending a request to the key manager, the request including the sensitive data type; and   the encryption key is associated with the sensitive data type.   
     
     
         5 . The method of  claim 4 , wherein the sensitive data type is one of a financial data type, personal information data type, and a medical data type. 
     
     
         6 . The method of  claim 1 , further comprising:
 storing the encryption key in an encryption key database; and   storing a sensitive data type identifier associated with the encryption key in the encryption key database.   
     
     
         7 . The method of  claim 6 , further comprising:
 storing a timestamp in the encryption key database, the timestamp associated with a first use of the encryption key;   determining an age of the encryption key based on comparing a current time and current date to a time and to a date identified in the timestamp;   determining whether the age of the encryption key is greater than a threshold age; and   responsive to a determination that the age of the encryption key is greater than the threshold age:   generating a new encryption key;   generating a new timestamp based on a current date and time;   overwriting the encryption key with the new encryption key; and   overwriting the timestamp with the new timestamp.   
     
     
         8 . A system, comprising:
 a live memory, the live memory including unencrypted nonsensitive data;   a central processing unit (CPU), the CPU configured to:   receive unencrypted sensitive data specified as a particular data type in source code with instructions compiled from the source code to encrypt the sensitive data for writing to the live memory;   determine an encryption key, the encryption key associated with the sensitive data;   prevent an unencrypted form of the sensitive data from being stored in the live memory, wherein the preventing includes:   encrypting the sensitive data based on the encryption key; and   writing the encrypted sensitive data to the live memory.   
     
     
         9 . The system of  claim 8 , wherein the CPU is further configured to:
 retrieve the encrypted sensitive data from the live memory;   determine a decryption key, the decryption key associated with the sensitive data; and   decrypt the encrypted sensitive based on the decryption key.   
     
     
         10 . The system of  claim 8 , wherein the receiving sensitive data comprises:
 receiving data, the data including one or more tags comprising sensitive data type information; and   determining, based on the one or more tags, that the data comprises sensitive data.   
     
     
         11 . The system of  claim 10 , wherein the CPU is further configured to determine, based on the one or more tags, a sensitive data type of the sensitive data, wherein the encryption key is associated with the sensitive data type. 
     
     
         12 . The system of  claim 11 , wherein the sensitive data type is one of a financial data type, personal information data type, and a medical data type. 
     
     
         13 . The system of  claim 8 , wherein the CPU is further configured to:
 store the encryption key in an encryption key database; and   store a sensitive data type identifier associated with the encryption key in the encryption key database.   
     
     
         14 . The system of  claim 13 , wherein the CPU is further configured to:
 store a timestamp in the encryption key database, the timestamp associated with a first use of the encryption key;   store a threshold age in the encryption key database;   determine an age of the encryption key based on comparing a current time and current date to a time and to a date identified in the timestamp;   determine whether the age of the encryption key is greater than the threshold age; and   responsive to a determination that the age of the encryption key is greater than the threshold age:   generate a new encryption key;   generate a new timestamp based on a current date and time;   overwrite the encryption key with the new encryption key; and   overwrite the timestamp with the new timestamp.   
     
     
         15 . A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:
 receive unencrypted sensitive data specified as a particular object type in source code with instructions compiled from the source code to encrypt the sensitive data for writing to a live memory, the live memory including unencrypted nonsensitive data;   determine an encryption key, the encryption key associated with the sensitive data;   prevent an unencrypted form of the sensitive data from being stored in the live memory, wherein the preventing includes:   encrypting the sensitive data based on the encryption key; and   writing the encrypted sensitive data to the live memory.   
     
     
         16 . The computer program product of  claim 15 , wherein the instructions further cause the computer to:
 retrieve the encrypted sensitive data from the live memory;   determine a decryption key, the decryption key associated with the sensitive data; and   decrypt the encrypted sensitive based on the decryption key.   
     
     
         17 . The computer program product of  claim 15 , wherein the receiving sensitive data comprises:
 receiving data, the data including one or more tags comprising sensitive data type information;   determining, based on the one or more tags, that the data comprises sensitive data.   
     
     
         18 . The computer program product of  claim 17 , wherein the instructions further cause the computer to determine, based on the one or more tags, a sensitive data type of the sensitive data, wherein the encryption key is associated with the sensitive data type. 
     
     
         19 . The computer program product of  claim 15 , wherein the instructions further cause the computer to:
 store the encryption key in an encryption key database; and   store a sensitive data type identifier associated with the encryption key in the encryption key database.   
     
     
         20 . The computer program product of  claim 19 , wherein the instructions further cause the computer to:
 store a timestamp in the encryption key database, the timestamp associated with a first use of the encryption key;   store a threshold age in the encryption key database;   determine an age of the encryption key based on comparing a current time and current date to a time and to a date identified in the timestamp;   determine whether the age of the encryption key is greater than the threshold age;   responsive to a determination that the age of the encryption key is greater than the threshold age:   generate a new encryption key;   generate a new timestamp based on a current date and time;   overwrite the encryption key with the new encryption key; and   overwrite the timestamp with the new timestamp.