Abstract: Security enhancement herein primarily relate to digital code undergoing a first fortification protocol by which a digital package is prepared, a secure execution environment being configured for use with the package at or via a source facility, and at least some of the package being executed in in the secure execution environment at a destination facility. Such enhanced configurations may arrive to or from a remote facility, for example, without a concomitant loss of performance.

Abstract: Improved systems and methods of providing computer security and countering attacks on computing systems by protecting control data such as a return address from being disclosed or modified. A stack canary is enhanced with randomization to prevent brute-force attacks and information leakage, providing a more effective sentinel to detect attempts to overwrite a return address on the stack. A shadow stack is enhanced with concealment of the return address from the stack, encoding of the return address in memory, and replacement of the real return address with a substitute value to detect attempted manipulation of the return address on the call stack and prevent it from succeeding. By enhancing randomization of the stack canary and using a shadow stack to encode and conceal the return address, the disclosed technology enhances security of a computing system against stack smashing, ROP attacks, and JIT-ROP attacks.

Abstract: First and second neighboring bit sequences containing machine language are determined to be (latently) separable. Such determination may be partly based on suitability for separation and partly based on environmental readiness, for example. If separability is determined, any of several response protocols may ensue. For example one or both of the bit sequences may be moved, modified, or trapped as part of a moving target defense.

Abstract: In some variants computing systems and methods are described in regard to establish a version of an operating system in a first computing environment monitored by a support interface (e.g. a hypervisor) and a version of a second operating system in a second environment also monitored by the support interface(s) so that the version of the first operating system supports a resource (e.g. a process) in the first computing environment; allowing the support interface to advance the first application function to and then pause the first application function in an operational state characterized by one or more operating parameters; and establishing polymorphed or other aliased second support interface to which to migrate the paused resource when appropriate.

Abstract: In some variants computing systems and methods are described in regard to protecting a first function in a first computing environment by proactively and selectively recording artifacts that support the function, thus allowing a computing environment to retrieve the older artifacts even after newer versions are implemented. Such proactive retention allows a restoration of or other reliable access to the function, even after attacks or other unnoticed changes to the function, optionally as a component of a software migration to a safer computing environment.

Abstract: Security-enhanced computing systems and methods are described in regard to a migration of at-risk software that is valid in a first language is translated to a second language and situated in a safer environment. If expressions in said first language are encountered in said safer environment, errors or other special handling may result.

Abstract: The present invention relates to methods and systems for binary scrambling, and applications for cybersecurity technology aimed at preventing cyber-attacks.

Abstract: The present invention relates to methods and systems for distributing scrambled binaries, binary scrambling, and applications for cybersecurity technology aimed at preventing cyber-attacks.

Abstract: Provided herein are systems and methods useful in facilitating containerized data security. The system may include a data store, a computer processing unit, a network interface, and memory. The memory may contain executable instructions for causing the system to perform a containerized data security method including obtaining a first external communication from a source external to the system; associating the first external communication with the first container; authenticating the first external communication with respect to the first container; providing the first external communication to an unencrypted instance of the first container in the memory; obtaining a first responsive communication from the unencrypted instance of the first container; and providing the first responsive communication to the source external to the system.

Abstract: Provided herein are systems and methods useful in facilitating containerized data security. The system may include a data store, a computer processing unit, a network interface, and memory. The memory may contain executable instructions for causing the system to perform a containerized data security method including obtaining a first external communication from a source external to the system; associating the first external communication with the first container; authenticating the first external communication with respect to the first container; providing the first external communication to an unencrypted instance of the first container in the memory; obtaining a first responsive communication from the unencrypted instance of the first container; and providing the first responsive communication to the source external to the system.