Systems and methods for memory management for virtual machines. An example method may comprise running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor which manages a Level 2 virtual machine. The Level 1 hypervisor may detecting execution of an operation that prevents modification to a set of entries in a Level 2 page table and generate a shadow page table where each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine. The Level 0 hypervisor may generate a Level 0 page table.

Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.

Temporary firmware is provided as cloud services. Different temporary firmware containers are downloaded via a communications network. A light-weight operating system launches and executes the temporary firmware containers during a boot operation, POST operation, or other scheme. The temporary firmware containers thus detect and perhaps resolve POST errors. The light-weight operating system may also download a full-service/resource operating system. A second or subsequent boot operation may be performed, but control is ceded to the full-service/resource operating system. Multiple firmware tenants may thus be temporarily downloaded to a bare metal machine to support POST error detection activities. Advanced OS serviceability, diagnostics, and other containerized firmware may thus be quickly and simply launched without requiring the excessive time and difficulties of using the full-service/resource operating system.

A method of executing computer-readable code for interaction with one or more data resources on a data processing platform, the method performed using one or more processors, comprising: receiving a request message including an identifier identifying executable code stored in a data repository; determining, using the identifier, an execution environment of a plurality of stored execution environments mapped to the identified executable code, wherein determining the execution environment mapped to the identified executable code comprises: accessing mapping data identifying a mapping between the identifier and the execution environment of the plurality of stored execution environments, the mapping data including configuration data associated with the identifier, wherein the configuration data identifies one or more convention-based data libraries particular to the execution environment; configuring the determined execution environment to access the one or more convention-based data libraries during execution; executing the identified executable code using the determined execution environment; and passing requests made with the identified executable code to the one or more data resources via a proxy.

A method for monitoring control-flow integrity in a low-level execution environment, the method comprising receiving, at a monitor, a message from the execution environment indicating that the execution environment has entered a controlled mode of operation, receiving, at the monitor, a data packet representing execution of a selected portion of a control-flow process at the execution environment, identifying, using the data packet, a pathway corresponding to the selected portion of the control-flow process from a set of permissible control-flow pathways and determining whether the identified pathway corresponds to an expected control-flow behaviour.

Example methods are provided for a host to perform authentication offload in a virtualized computing environment that includes the host and a destination server. The method may comprise detecting, from a virtualized computing instance, a packet destined for the destination server. The method may also comprise: in response to determination that the detected packet is an authentication request, obtaining, from the virtualized computing instance, metadata associated with a client application for which authentication is requested; and sending the authentication request and the metadata to the destination server to cause the destination server to authenticate the client application based on the metadata.

A method includes exposing a public cryptographic key associated with a peripheral device of a computing system to a guest running on the computing system. The method further includes receiving, from the guest, a message including a cryptographic nonce value encrypted with the public cryptographic key. The method further includes producing the cryptographic nonce value by decrypting the message using a private cryptographic key associated with the public cryptographic key. The method further includes using a shared cryptographic key generated from the cryptographic nonce value to access contents of a direct memory access (DMA) buffer associated with the peripheral device.

In order to appropriately provide information related to vulnerability that may be included in a container as a transmission target, a transmission apparatus 100a includes an information obtaining unit 131 configured to obtain information related to a change-prohibited region included in a container 2 to be transmitted, information indicating that the change-prohibited region has not been changed, and information related to vulnerability inspection for the change-prohibited region, and a transmission processing unit 133 configured to include, in the container 2, the information related to the change-prohibited region, the information indicating that the change-prohibited region has not been changed, and the information related to the vulnerability inspection for the change-prohibited region, and transmit the container 2.

An automotive gateway includes one or more interfaces and one or more processors. The one or more interfaces are configured to communicate with electronic subsystems of a vehicle. The one or more processors and configured to host one or more guest applications and to control communication traffic between the one or more guest applications and the electronic subsystems of the vehicle in accordance with a security policy.

Examples described herein include systems and methods for fuzz testing low-level virtual devices and virtual devices with DMA write functionality. A fuzz tester includes components distributed across a virtual machine and its host system. The fuzz testing components in the virtual machine are implemented as firmware installed in the virtual machine's ROM. These components operate independent of data stored in the virtual machine's RAM and do not require an operating system to be installed on the virtual machine. As a result, any changes made to the virtual machine's RAM during the fuzzing process by low-level virtual devices or virtual devices with DMA write functionality cannot interrupt the fuzz testing or otherwise negatively impact the fuzz tester itself.