One aspect of the invention provides a method of controlling execution of a computer
program. The method comprises the following runtime steps: parsing code to identify one or …

The promise of software sandboxing is flexible, fast and portable isolation; capturing the
benefits of hardwarebased memory protection without requiring operating system …

Spectre attacks and their many subsequent variants are a new vulnerability class affecting
modern CPUs. The attacks rely on the ability to misguide speculative execution, generally by …

Code-reuse attacks are notoriously hard to defeat, and most current solutions to the problem
focus on automated software diversity. This is a promising area of research, as diversity …

Managed languages such as JavaScript are popular. For performance, modern
implementations of managed languages adopt Just-In-Time (JIT) compilation. The danger to …

Software-based fault isolation (SFI), as used in Google's Native Client (NaCl), relies upon a
conceptually simple machine-code analysis to enforce a security policy. But for complicated …

Control-Flow Integrity (CFI) is an important security property that needs to be enforced to
prevent controlflow hijacking attacks. Recent attacks have demonstrated that existing CFI …

One aspect of the invention provides a method of controlling execution of a computer
program. The method comprises the following runtime steps: parsing code to identify one or …

Many applications, from the Web to smart contracts, need to safely execute untrusted code.
We observe that WebAssembly (Wasm) is ideally positioned to support such applications …

As a hardware mechanism for facilitating intra-process memory isolation, Intel Memory
Protection Keys (MPK) has been leveraged to efficiently improve the isolation, security, or …