Abstract: Techniques for protecting the contents of a computing device are provided. The techniques include associating security level information with each of a plurality of content items to be protected, the security level information including an integrity check action and a resultant behavior to be performed for each respective content item. The security level information can be built into an image comprising the content items to be protected and the image can be installed on a computing device. The techniques include accessing security level information associated with a content item responsive to a request to perform an action on the content, performing the integrity check action associated with the content item, and performing the resultant behavior associated with the content item responsive to the integrity check action indicating that the action requested cannot be performed.

Abstract: Systems, methods, and devices of the various aspects enable method of cross-module behavioral validation. A plurality of observer modules of a system may observe behavior or behaviors of a observed module of the system. Each of the observer modules may generate a behavior representation based on the behavior or behaviors of the observed module. Each observer module may apply the behavior representation to a behavior classifier model suitable for each observer module. The observer modules may aggregate classifications of behaviors of the observed module determined by each of the observer modules. The observer modules may determine, based on the aggregated classification, whether the observed module is behaving anomalously.

Abstract: Disclosed is a method for performing a message integrity check. In the method, a processor reads a message from a storage device. The message comprises a plurality of first level sections. The processor determines one or more second level sections from the plurality of first level sections. Each second level section comprises a fixed number of first level sections. A crypto engine calculates a hash value for each second level section to generate a respective calculated hash value, and a hash value for each first level section not included in a second level section to generate a respective calculated hash value. The processor compares each of the respective calculated hash values with a corresponding stored hash value. The processor provides an integrity check indication if each respective calculated hash value is equal to the corresponding stored hash value.

Abstract: Techniques for protecting the contents of a computing device are provided. The techniques include associating security level information with each of a plurality of content items to be protected, the security level information including an integrity check action and a resultant behavior to be performed for each respective content item. The security level information can be built into an image comprising the content items to be protected and the image can be installed on a computing device. The techniques include accessing security level information associated with a content item responsive to a request to perform an action on the content, performing the integrity check action associated with the content item, and performing the resultant behavior associated with the content item responsive to the integrity check action indicating that the action requested cannot be performed.

Abstract: Disclosed is a method for inheriting a non-secure thread context. In the method, a first secure monitor call associated with a first non-secure thread of a non-secure environment of a processing system is received. A first secure thread is created, in response to the first secure monitor call, that inherits a first interrupt state of the first non-secure thread.

Abstract: Disclosed is an apparatus and method to authorize an application for use. A computing device may utilize an application and may include a secure memory and a processor. The processor may: create a unique digest for the application upon a first boot-up; store the unique digest in the secure memory; calculate an application digest for the application upon a subsequent boot-up; and if the calculated application digest matches the stored unique digest, authorize the application for use.

Abstract: Disclosed is a method for inheriting a non-secure thread context. In the method, a first secure monitor call associated with a first non-secure thread of a non-secure environment of a processing system is received. A first secure thread is created, in response to the first secure monitor call, that inherits a first interrupt state of the first non-secure thread.