Abstract: In one embodiment, a system comprises a processor to, in response to a determination that a write command is suspect, identify a logical address associated with the write command; and send a checkpoint command identifying the logical address to a storage device to preserve data stored in the storage device at a physical address associated with the logical address.

Abstract: A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

Abstract: Embodiments include a computing processor control flow enforcement system including a processor, a block cipher encryption circuit, and an exclusive-OR (XOR) circuit. The control flow enforcement system uses a block cipher encryption to authenticate a return address when returning from a call or interrupt. The block cipher encryption circuit executes a block cipher encryption on a first number including an identifier to produce a first encrypted result and executes a block cipher encryption on a second number including a return address and a stack location pointer to produce a second encrypted result. The XOR circuit performs an XOR operation on the first encrypted result and the second encrypted result to produce a message authentication code tag.

Abstract: In an embodiment, a processor comprises Return Oriented Programming (ROP) logic to: detect a first branch event at a first point in time; determine whether the first branch event is indirect; in response to a determination that the first branch event is an indirect branch event, determine whether a memory location referenced by the indirect branch event is specified as read-only; and in response to a determination that the memory location referenced by the indirect branch event is specified as read-only, convert the first branch event to a direct branch event. Other embodiments are described and claimed.

Abstract: Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Abstract: Embodiments of techniques and systems for increasing efficiencies in computing systems using virtual memory are described. In embodiments, instructions which are located in two memory pages in a virtual memory system, such that one of the pages does not permit execution of the instructions located therein, are identified and then executed under temporary permissions that permit execution of the identified instructions. In various embodiments, the temporary permissions may come from modified virtual memory page tables, temporary virtual memory page tables which allow for execution, and/or emulators which have root access. In embodiments, per-core virtual memory page tables may be provided to allow two cores of a computer processor to operate in accordance with different memory access permissions. In embodiments, a physical page permission table may be utilized to provide for maintenance and tracking of per-physical-page memory access permissions. Other embodiments may be described and claimed.

Abstract: A data processing system (DPS) uses platform protection technology (PPT) to protect some or all of the code and data belonging to certain software modules. The PPT may include a virtual machine monitor (VMM) to enable an untrusted application and a trusted application to run on top of a single operating system (OS), while preventing the untrusted application from accessing memory used by the trusted application. The VMM may use a first extended page table (EPT) to translate a guest physical address (GPA) into a first host physical address (HPA) for the untrusted application. The VMM may use a second EPT to translate the GPA into a second HPA for the trusted application. The first and second EPTs may map the same GPA to different HPAs. Other embodiments are described and claimed.

Abstract: A processor comprises a register to store a first pointer to a context data structure specifying a virtual machine context, the context data structure comprising a first field to store a second pointer to a plurality of realm switch control structures (RSCSs), and an execution unit comprising a logic circuit to execute a virtual machine (VM) according to the virtual machine context, wherein the VM comprises a guest operating system (OS) comprising a plurality of kernel components, and wherein each RSCS of the plurality of RSCSs specifies a respective component context associated with a respective kernel component of the plurality of kernel components, and execute a first kernel component of the plurality of kernel components using a first component context specified by a first RSCS of the plurality of RSCSs.

Abstract: In an embodiment, a processor for Return Oriented Programming (ROP) detection includes at least one execution unit; a plurality of event counters, each event counter associated with a unique type of a plurality of types of control transfer events; and a ROP detection unit. The ROP detection unit may be to: adjust a first event counter in response to detection of a first type of control transfer events; in response to a determination that the first event counter exceeds a first threshold, access a first configuration register associated with the first event counter to read configuration data; identify a set of ROP heuristic checks based on the configuration data read from the first configuration register; and perform each ROP heuristic check of the identified set of ROP heuristic checks. Other embodiments are described and claimed.

Abstract: According to some embodiments an electronic processing system may include a processor, memory coupled to the processor, and security code stored on the memory which when executed by the processor is to provide a trusted execution environment. A storage system may be coupled to the processor from outside of the trusted execution environment. The storage system may include a persistent storage media, a storage controller coupled to the persistent storage media, operating system code stored on the persistent storage media which when executed by the processor is to manage a file system for the electronic processing system, and storage controller code stored on the persistent storage media which when executed by the storage controller is to provide a transport layer between the file system and the persistent storage media. A sideband interface may be coupled between the storage system and the trusted execution environment bypassing the transport layer and the file system.

Abstract: Technologies for code flow integrity protection include a static analyzer that identifies a potential gadget in an atomic code path of a protected code. A marker instruction is inserted after the potential gadget with a parameter that corresponds to an address of the marker instruction, a hash evaluator instruction is inserted after an exit point of the atomic code path with a parameter that corresponds to the address of the marker instruction, and a compare evaluator instruction and a hash check instruction are inserted after the hash evaluator instruction. A target computing device executes the protected code and updates a path hash as a function of the parameter of the marker instruction, determines an expected hash value as a function of the parameter of the hash evaluator instruction, and generates an exception if the path hash and the expected hash value do not match. Other embodiments are described and claimed.

Abstract: Technologies are provided in embodiments to provide access control for applications in a computing environment. Particular embodiments are configured to identify a code region of a code segment in an application, determine a resource to be allocated to the code region, and prior to the application execution, authorize the code region to access the resource during an execution of the code region. In specific embodiments, authorizing the code region includes embedding at least one token in the code region. In other specific embodiments, authorizing the code region includes associating an identity of the code region with the resource. In further embodiments, when the compiled application is executed, a segment load instruction associated with the resource is to attempt to verify the code region is authorized to access the resource, and allow execution of the code region based, at least in part, on the verification.

Abstract: A processing system includes a processing core to execute a virtual machine (VM) comprising a guest operating system (OS) and a memory management unit, communicatively coupled to the processing core, comprising a storage device to store an extended page table entry (EPTE) comprising a mapping from a guest physical address (GPA) associated with the guest OS to an identifier of a memory frame, a first plurality of access right flags associated with accessing the memory frame in a first page mode referenced by an attribute of a memory page identified by the GPA, and a second plurality of access right flags associated with accessing the memory frame in a second page mode referenced by the attribute of the memory page identified by the GPA.

Abstract: Systems and methods are described herein that discuss how a computing platform executing a virtualized environment, in one example, can be integrity verified adaptively and on demand. This may occur at initial runtime, as well as during continued operations, and allows the platform user to install software from various vendors without sacrificing the integrity measurement and therefore the trustworthiness of the platform.

Abstract: A processing system includes a processing core to execute a task and a memory management unit, coupled to the core. The memory management unit includes a protection key register comprising a plurality of fields. Each field comprising a set of bits reflecting a memory access permission for each of a plurality of memory domains. The memory management unit also includes a plurality of protection key mask registers. Each of the protection key mask registers comprising a mask having a plurality of bits, each bit reflecting an access permission to a corresponding field of the protection key register by a code page residing in a memory domain of the plurality of memory domains identified by an index of the protection key mask register.

Abstract: A technique allows for a hybrid hypervisor-assisted security model that monitors and protects an operating system from rootkits or other malware through use of monitoring policies for the operating system (OS). The OS monitoring policies may be separated into rules that can be enforced using an in-guest agent running in a monitored guest OS domain and an out-of-guest agent running in a privileged/monitoring guest OS domain. Embodiments may use virtualization technologies including permissions and policies in one or more page tables (and virtualization exceptions (#VE) to avoid virtual machine (VM) exits during runtime events and thereby, avoid context switching into a hypervisor. An embodiment includes configuring the in-guest agent in a monitored OS such that hardware events can be switched to lightweight events and can be dynamically switched to complex processing in the privileged OS domain only when requested.

Abstract: Technologies for hardware assisted native malware detection include a computing device. The computing device includes one or more processors with hook logic to monitor for execution of branch instructions of an application, compare the monitored branch instructions to filter criteria, and determine whether a monitored branch instruction satisfies the filter criteria. Additionally, the computing device includes a malware detector to provide the filter criteria to the hook logic, provide an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction satisfies the filter criteria, and analyze, in response to execution of the callback function, the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware. Other embodiments are also described and claimed.

Abstract: A method, system, computer-readable media, and apparatus for ensuring a secure cloud environment is provided, where public cloud services providers can remove their code from the Trusted Computing Base (TCB) of their cloud services consumers. The method for ensuring a secure cloud environment keeps the Virtual Machine Monitor (VMM), devices, firmware and the physical adversary (where a bad administrator/technician attempts to directly access the cloud host hardware) outside of a consumer's Virtual Machine (VM) TCB. Only the consumer that owns this secure VM can modify the VM or access contents of the VM (as determined by the consumer).

Abstract: A system and method for high performance secure access to a trusted platform module on a hardware virtualization platform. The virtualization platform including Virtual Machine Monitor (VMM) managed components coupled to the VMM. One of the VMM managed components is a TPM (Trusted Platform Module). The virtualization platform also includes a plurality of Virtual Machines (VMs). Each of the virtual machines includes a guest Operating System (OS), a TPM device driver (TDD), and at least one security application. The VMM creates an intra-partition in memory for each TDD such that other code and information at a same or higher privilege level in the VM cannot access the memory contents of the TDD. The VMM also maps access only from the TDD to a TPM register space specifically designated for the VM requesting access. Contents of the TPM requested by the TDD are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD.

Abstract: In one embodiment, an apparatus comprises a processor configured to: detect a first control transfer operation; determine that a destination of the first control transfer operation is within code stored in execute-only memory; generate a fault if the destination of the first control transfer operation is an invalid entry point into the code stored in execute-only memory; detect a second control transfer operation while executing the code stored in execute-only memory; and abort execution of the code stored in execute-only memory if the second control transfer operation is detected at an invalid exit point in the code.