Technologies for protecting dynamically generated managed code with protection domains

A method for managed code execution, the method comprising:

• setting, by a computing device, a protection key register of a processor of the computing device with first permissions, wherein the first permissions disallow data access to any protection domain of the computing device;
• executing, by the computing device, a domain switch routine to switch to a managed applet in response to setting the protection key register with the first permissions, wherein the managed applet is managed by a managed runtime environment, and wherein the managed runtime environment is included in a first protection domain, the domain switch routine is included in a second protection domain, and the managed applet is included in a third protection domain;
• setting, by the computing device, the protection key register with second permissions in response to executing the domain switch routine, wherein the second permissions disallow data access to any protection domain of the computing device other than the third protection domain;
• and
• executing, by the computing device, the managed applet in response to setting the protection key register with the second permissions.

One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:

• set a protection key register of a processor of the computing device with first permissions, wherein the first permissions disallow data access to any protection domain of the computing device;
• execute a domain switch routine to switch to a managed applet in response to setting the protection key register with the first permissions, wherein the managed applet is managed by a managed runtime environment, and wherein the managed runtime environment is included in a first protection domain, the domain switch routine is included in a second protection domain, and the managed applet is included in a third protection domain;
• set the protection key register with second permissions in response to executing the domain switch routine, wherein the second permissions disallow data access to any protection domain of the computing device other than the third protection domain;
• and
• execute the managed applet in response to setting the protection key register with the second permissions.