Using software-based decision procedures to control instruction-level execution

An apparatus comprising:

• a memory configured to contain memory pages;
• a processor;
• and program code configured to be executed by the processor to secure a computer system, the program code further configured to check a digital signature of an application to load into memory;
• in response to finding a valid digital signature:
• set a plurality of memory pages containing instructions of the application as executable,
• and set a plurality of memory pages other than those containing instructions of the application as non-executable;
• execute instructions in the plurality of executable memory pages;
• prevent execution of instructions in the plurality of non-executable memory pages;
• and generate a page fault in response to an attempt to execute an instruction in a non-executable memory page of the non-executable memory pages, wherein in response to the generation of the page fault the program code is further configured to:
• check a whitelist of a sequence of instructions for the attempted instruction in the non-executable memory page;
• wherein the sequence of instructions is computer program code;
• set the non-executable memory page to an executable memory page if the attempted instruction is included in the whitelist;
• and execute the attempted instruction in the executable memory page.

A program product comprising:

• a non-transitory computer recordable type medium;
• and a program code configured to secure a computer system, the program code resident on the computer recordable type medium and further configured, when executed on a hardware implemented processor, to check a digital signature of an application to load into memory;
• in response to finding a valid digital signature:
• set a plurality of memory pages containing instructions of the application as executable, and set a plurality of memory pages other than those containing instructions of the application as non-executable;
• execute instructions in the plurality of executable memory pages;
• prevent execution of instructions in the plurality of non-executable memory pages;
• and generate a page fault in response to an attempt to execute an instruction in a non-executable memory page of the non-executable memory pages, wherein in response to the generation of the page fault the program code is further configured to:
• check a whitelist of a sequence of instructions for the attempted instruction in the non-executable memory page;
• wherein the sequence of instructions is computer program code;
• set the non-executable memory page to an executable memory page if the attempted instruction is included in the whitelist;
• and execute the attempted instruction in the executable memory page.