Abstract: A technique for detecting malware uses hardware capabilities of the processing element of a programmable device to detect modification of executable code during execution. By monitoring a dirty bit in page tables, pages that have been modified can be detected, allowing analysis of those pages during execution. An indication may then be passed to an anti-malware software to analyze the executable further.

Abstract: Apparatus, methods and systems to associate a flight plan of an unmanned aerial vehicle (e.g., a drone) with a cryptographic signature are disclosed herein. Some disclosed examples include one or more non-transitory computer-readable media including computer-executable instructions. The computer readable instructions, when executed by one or more processors, cause the one or more processors to compare a flight path over a geographic area of an unmanned aerial vehicle to a geographically identified no-fly zone. The flight path is included in a flight plan. The instructions also cause the vehicle to determine whether the flight path enters the geographically identified no-fly zone, and based on whether the flight path is determined to enter the geographically identified no-fly zone, associate the flight plan with a cryptographic signature.

Abstract: A technique allows a client computer with a web browser to receive a web page having active content in response to transmitting a request for content. The active content includes a signature and a set of attributes associated with a web domain. The web browser can interpret the signature and the set of attributes as formatted in the active content. Validation of the signature and the set of attributes can be in a secure mode through a secure enclave module.

Abstract: In an example, there is disclosed a computing apparatus, including: a driver identity detector to detect the identity of a driver; and one or more logic elements providing a driver competency engine, operable to: detect the identity of the driver; evaluate the driver's operation of a vehicle; and build a driver competency profile based at least in part on the evaluating. The driver competency engine may further be operable to detect a context of the operation, such as environmental factors. There is also described a method of providing a driver competency engine, and one or more computer readable mediums having stored thereon executable instructions for providing a driver competency engine.

Abstract: Certain embodiments herein relate to location verification for autonomous unmanned aerial vehicles (also referred to as “drones”). In some embodiments, an unmanned aerial vehicle engaged in autonomous flight may determine its location using a satellite-based navigation system. The location may be evaluated against location data obtained from one or more secondary factors, such as public broadcast beacons, cellular towers, wireless network identifiers, visual markers, or any combination thereof. If the location is determined to be invalid, the unmanned aerial vehicle may be instructed to take a mitigation action. Additionally, certain embodiments also include the verification of a flight plan for the unmanned aerial vehicle using secure no-fly logic to verify a flight plan does not violate no-fly zones. If the flight plan is verified, the flight plan may be signed using a cryptographic signature and provided to a navigation module that verifies the signature and executes the flight plan.

Abstract: In an example, there is disclosed a computing apparatus, having a computing resource; a bespoke sensor for measuring at least one parameter of usage of the computing resource; and one or more logic elements providing a trusted compute meter (TCM) agent to: receive an external workload; provision a workload enclave; execute the external workload within the TCM enclave; and measure resource usage of the external workload via the bespoke sensor. There is also disclosed a computer-readable medium having stored thereon executable instructions for providing a TCM agent, and a method of providing a TCM agent.

Abstract: In an example, there is disclosed a computing apparatus, including a processor, including a trusted execution instruction set; a memory having an enclave portion, wherein the enclave is accessible only via the trusted execution instruction set; a swap file; and a memory management engine operable to: allocate a buffer within the enclave; receive a scope directive to indicate that the buffer is in scope; and protect the buffer from swapping to the swap file while the buffer is in scope. There is further disclosed an method of providing a memory management engine, and one or more computer-readable storage mediums having stored thereon executable instructions for providing the memory management engine.

Abstract: This disclosure describes systems and methods related to utilizing hardware assisted protection for media content. In some embodiments, a provided method comprises: receiving, from a content server and by a computing device processor of a secure enclave of a device, first encrypted media content; decrypting, by the computing device processor, the first encrypted media content using a first decryption key; generating, by the computing device processor, a second decryption key; encrypting, by the computing device processor, the first decrypted media content using the second key, thereby resulting in second encrypted media content; and sending, by the computing device processor and to one or more graphical processing units (GPUs) comprised in a graphics component of the device, the second encrypted media content and the second decryption key.

Abstract: In an example, there is disclosed a computing apparatus, including: a driver identity detector to detect the identity of a driver; and one or more logic elements providing a driver competency engine, operable to: detect the identity of the driver; evaluate the driver's operation of a vehicle; and build a driver competency profile based at least in part on the evaluating. The driver competency engine may further be operable to detect a context of the operation, such as environmental factors. There is also described a method of providing a driver competency engine, and one or more computer readable mediums having stored thereon executable instructions for providing a driver competency engine.

Abstract: In an example, there is disclosed a computing apparatus, including a processor, including a trusted execution instruction set; a memory having an enclave portion, wherein the enclave is accessible only via the trusted execution instruction set; a swap file; and a memory management engine operable to: allocate a buffer within the enclave; receive a scope directive to indicate that the buffer is in scope; and protect the buffer from swapping to the swap file while the buffer is in scope. There is further disclosed an method of providing a memory management engine, and one or more computer-readable storage mediums having stored thereon executable instructions for providing the memory management engine.

Abstract: In an example, there is disclosed a computing apparatus, comprising: a trusted execution environment (TEE); and a security engine operable to: identify a key negotiation for an encrypted connection between a first device and a second device; request a service appliance key for the key negotiation; receive the service appliance key; and perform a service appliance function on traffic between the first device and the second device. There is also disclosed a method of providing the security engine, and a computer-readable medium having stored thereon executable instructions for providing the security engine.

Abstract: Certain embodiments herein relate to location verification for autonomous unmanned aerial vehicles (also referred to as “drones”). In some embodiments, an unmanned aerial vehicle engaged in autonomous flight may determine its location using a satellite-based navigation system. The location may be evaluated against location data obtained from one or more secondary factors, such as public broadcast beacons, cellular towers, wireless network identifiers, visual markers, or any combination thereof. If the location is determined to be invalid, the unmanned aerial vehicle may be instructed to take a mitigation action. Additionally, certain embodiments also include the verification of a flight plan for the unmanned aerial vehicle using secure no-fly logic to verify a flight plan does not violate no-fly zones. If the flight plan is verified, the flight plan may be signed using a cryptographic signature and provided to a navigation module that verifies the signature and executes the flight plan.

Abstract: This disclosure describes systems, methods, and computer-readable media related to phishing and brand protection via copycat detection. In some embodiments, a temporary page profile associated with a webpage may be generated. The temporary page profile may include an image component, a geometry component, a style component, and a link component. One or more baseline page profiles may be retrieved. The temporary page profile and the one or more baseline page profiles may be compared. It may be determined that the temporary page profile does not match the one or more baseline page profiles. An alert may be generated to display to a user indicating that fraud has been detected for the webpage.

Abstract: A technique allows a client computer with a web browser to receive a web page having active content in response to transmitting a request for content. The active content includes a signature and a set of attributes associated with a web domain. The web browser can interpret the signature and the set of attributes as formatted in the active content. Validation of the signature and the set of attributes can be in a secure mode through a secure enclave module.

Abstract: Organizing a trusted network includes receive, by a local device, a message from a first remote trusted device identifying a first service hosted by the first remote trusted device, wherein the local device and the first remote trusted device are in a trusted network. Organizing a trusted network also includes indexing, by the local device, the first service in a registry comprising services available to the local device and a location of each service available, wherein the registry is local to the local device.