Systems and methods for creating program-specific execution environments

The disclosed computer-implemented method for creating program-specific execution environments may include (1) identifying a privileged software program to be executed on a client system in a program-specific execution environment, (2) establishing the program-specific execution environment by (a) determining that at least one process executing on the client system is not essential to operation of the privileged software program to be executed on the client system and (b) suspending execution of the non-essential process in response to identifying the non-essential process, and (3) initiating execution of the privileged software program in the program-specific execution environment. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

As computing systems have become increasingly powerful, they have supported an ever-increasing number of processes executing at any given time. For example, many programs install update processes that run constantly, awaiting notification of software updates to be installed. Various services execute as background processes or daemons, waiting for service requests from programs, devices, or users. In addition to legitimate processes, various forms of malware or adware may be executing on a computing system at any given time. For example, a key logger may be watching a user's keystrokes for sensitive information like passwords or credit card numbers.

The various processes executing on a computing system at any given moment may create a number of problems. In addition to the security threats posed by malware, all these executing processes can impact system performance. Software bugs can cause other programs or the entire computing system to crash. In some cases, operations performed by one program may interfere with the operations of another program. For example, a user performing a time-sensitive task in one program may be interrupted by a program updater starting to download and install an update to another program. The instant disclosure, therefore, identifies and addresses a need for systems and methods for creating program-specific execution environments.

SUMMARY

As will be described in greater detail below, the instant disclosure describes various systems and methods for creating program-specific execution environments.

In one example, a computer-implemented method for creating program-specific execution environments may include (i) identifying a privileged software program to be executed on a client system in a program-specific execution environment, (ii) establishing the program-specific execution environment by (a) determining that one or more processes executing on the client system are not essential to operation of the privileged software program to be executed on the client system and (b) suspending execution of the non-essential process in response to identifying the non-essential process, and (iii) initiating execution of the privileged software program in the program-specific execution environment.

In some examples, suspending execution of the non-essential process may include using one or more application programming interfaces of an operating system of the client system to suspend the process. In some examples, suspending execution of the non-essential process may include intercepting an entry point of the process. In one embodiment, the computer-implemented method may further include (i) intercepting an attempt to initiate a new process not yet executing on the client system, (ii) determining that the new process is not essential to operation of the privileged software program, and (iii) in response to determining that the new process is non-essential, preventing the new process from initiating.

In one embodiment, the computer-implemented method may further include (i) identifying one or more tasks to be performed by the privileged software program, (ii) identifying a set of functions of the privileged software program essential to performing the task, and (iii) preventing the privileged software program from performing one or more functions not included in the set of essential functions. In some examples, preventing the privileged software program from performing the function not included in the set of essential functions may include preventing the privileged software program from initiating a process. In some examples, determining that the process is not essential to operation of the privileged software program may include querying a process dependency database using a unique identifier for the privileged software program and receiving, in response to querying the process dependency database, an indication that the process is not essential to operation of the privileged software program.

In one embodiment, the computer-implemented method may further include identifying one or more processes executing on the client system that perform one or more functions essential to operation of the privileged software program and one or more functions not essential to operation of the privileged software program and initiating a replacement process that performs the essential function but does not perform the non-essential function. In one embodiment, the process may include a device driver.

In one embodiment, a system for implementing the above-described method may include several modules stored in memory, such as (i) an identification module that identifies a privileged software program to be executed on a client system in a program-specific execution environment, (ii) a determination module and (iii) a control module that establish the program-specific execution environment by (a) the determination module determining that one or more processes executing on the client system are not essential to operation of the privileged software program to be executed on the client system, and (b) the control module suspending execution of the non-essential process in response to identifying the non-essential process, and (iv) an initiation module that initiates execution of the privileged software program in the program-specific execution environment. The system may also include at least one physical processor configured to execute the identification module, the determination module, the control module, and the initiation module.

In some examples, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, a computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to (i) identify a privileged software program to be executed on a client system in a program-specific execution environment, (ii) establish the program-specific execution environment by (a) determining that one or more processes executing on the client system are not essential to operation of the privileged software program to be executed on the client system and (b) suspending execution of the non-essential process in response to identifying the non-essential process, and (iii) initiate execution of the privileged software program in the program-specific execution environment.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

The present disclosure is generally directed to systems and methods for creating program-specific execution environments.

As will be explained in greater detail below, by identifying and suspending non-essential processes, the systems and methods described herein may establish a program-specific execution environment that may protect a privileged software program from operational interference, security threats, software bugs, and/or performance degradation caused by other programs or processes. The systems and methods described herein may also restrict the functionality of the privileged software program to functions essential to performing a particular task, which may improve the performance and/or security of the privileged software program while performing the task. By establishing a program-specific execution environment in this way, the systems and methods described herein may improve the security and/or performance of privileged software programs, when compared to conventional execution environments.

In addition, the systems and methods described herein may improve the functioning of a computing device by improving the security and/or performance of a privileged software program, and thereby improve overall information security and system responsiveness to user needs. These systems and methods may also improve the field of computing system performance and security by providing a method for securely executing a privileged software program.

The following will provide, with reference toFIGS. 1, 2, and 4detailed descriptions of example systems for creating program-specific execution environments. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIG. 3. In addition, detailed descriptions of an example computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 5 and 6, respectively.

FIG. 1is a block diagram of example system100for creating program-specific execution environments. As illustrated in this figure, example system100may include one or more modules102for performing one or more tasks. For example, and as will be explained in greater detail below, example system100may include an identification module104that identifies a privileged software program to be executed on a client system in a program-specific execution environment. Example system100may additionally include a determination module106and a control module108that establish the program-specific execution environment by the determination module106determining that one or more processes executing on the client system are not essential to operation of the privileged software program to be executed on the client system, and the control module108suspending execution of the non-essential process in response to identifying the non-essential process. Example system100may also include an initiation module110that initiates execution of the privileged software program in the program-specific execution environment. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application.

As illustrated inFIG. 1, example system100may also include one or more databases, such as process dependency database120. In one example, process dependency database120may be configured to store dependencies between software programs and/or between software programs and operating system processes. Process dependency database120may represent portions of a single database or computing device or a plurality of databases or computing devices. For example, process dependency database120may represent a portion of server206inFIG. 2, computing system510inFIG. 5, and/or portions of example network architecture600inFIG. 6. Alternatively, process dependency database120may represent one or more physically separate devices capable of being accessed by a computing device, such as server206inFIG. 2, computing system510inFIG. 5, and/or portions of example network architecture600inFIG. 6.

Example system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of example system100may represent portions of example system200inFIG. 2. As shown inFIG. 2, system200may include a client system202in communication with a server206via a network204. In one example, all or a portion of the functionality of modules102may be performed by client system202, server206, and/or any other suitable computing system. As will be described in greater detail below, one or more of modules102fromFIG. 1may, when executed by at least one processor of client system202and/or server206, enable client system202and/or server206to create program-specific execution environments. For example, and as will be described in greater detail below, one or more of modules102may cause client system202and/or server206to create a program-specific execution environment212on client system202for the execution of software program208. For example, and as will be described in greater detail below, identification module104may identify privileged software program208to be executed on client system202in program-specific execution environment212. Determination module106and control module108may establish program-specific execution environment212. To do so, determination module106may determine that at least one process executing on client system202(e.g., a non-essential process210) is not essential to operation of a software program208to be executed on client system202. Control module108may suspend execution of non-essential process210in response to identifying non-essential process210. Initiation module110may initiate execution of software program208in program-specific execution environment212.

Client system202generally represents any type or form of computing device capable of reading computer-executable instructions. For example, client system202may be an endpoint device running client-side security software. Additional examples of client system202include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), gaming consoles, variations or combinations of one or more of the same, and/or any other suitable computing device.

Server206generally represents any type or form of computing device that is capable of receiving, comparing, storing, and transmitting data. In one embodiment, server206may represent a backend server configured to store process dependencies, such as dependencies between software programs and/or between software programs and operating system processes. Additional examples of server206include, without limitation, security servers, application servers, web servers, storage servers, and/or database servers configured to run certain software applications and/or provide various security, web, storage, and/or database services. Although illustrated as a single entity inFIG. 2, server206may include and/or represent a plurality of servers that work and/or operate in conjunction with one another.

As illustrated inFIG. 3, at step302, one or more of the systems described herein may identify a privileged software program to be executed on a client system in a program-specific execution environment. For example, identification module104may, as part of client system202inFIG. 2, identify privileged software program208to be executed on client system202in program-specific execution environment212.

The phrase “privileged software program,” as used herein, generally refers to a software program that merits protection from interference by other software programs or processes. A software program may, for example, be designated as privileged by a user or administrator for reasons of security, performance, or operational priority. A user may, for example, designate a game program as privileged to prevent the game from being interrupted by messaging systems or update programs. In another example, a user may designate any of several browser-based banking programs as privileged to protect the programs from malware. In some examples, one or more of the systems described herein may designate a software program as privileged. For example, one or more of the systems described herein may designate a software program as privileged by observing a performance, stability, operational, and/or security failure with the software program and remedying the failure (e.g., in subsequent executions of the software program) by designating the software program as privileged.

In some examples, a software vendor, an operating system vendor, and/or a security vendor may designate a software program as privileged based on data relating to the software program. For example, a security vendor may designate a software program as privileged based on determining that the software program has a vulnerability, processes sensitive operations and/or data, and/or is disproportionately targeted by malicious attacks. Similarly, a software vendor and/or an operating system vendor may designate a software program as privileged based on statistics of adverse performance, stability, and/or operational issues observed in the software program (e.g., across various computing systems). In some examples, a vendor may designate a software program as privileged only for a class of computing systems (e.g., those computing systems on which the software program is known and/or predicted to encounter adverse performance, stability, operational, and/or security issues at a rate above a predetermined threshold).

The term “program-specific execution environment,” as used herein, generally refers to a computing environment that includes a restricted set of executing programs and/or processes necessary to execute a specific software program. For example, creating a program-specific execution environment for a gaming program may involve suspending programs or processes that may interfere with the game's display mode or degrade the performance of the client system. If the game does not require access to a printer, creating the program-specific execution environment may involve suspending a background printing process or disabling a printer driver. In some examples, a program-specific execution environment may be configured to support only a subset of a specific program's features such that the execution environment may be tailored to accomplishing a specific task. For example, a program-specific execution environment for an organization's accounting program may prevent access to networks other than the organization's virtual private network or to file systems other than a secure server, to ensure that sensitive financial information is not maliciously or inadvertently transmitted to an unauthorized recipient.

Identification module104may identify a privileged software program in any of a variety of ways. For example, identification module104may determine a software program's privilege status by accessing a software policy file or database, which may be local to the client system or stored on a server. The software policy may be established by a user or administrator. In some examples, identification module104may receive the privilege status of the software policy as input from the user or administrator. In another example, a software publisher may provide a utility program for creating a program-specific execution environment or include creation of a program-specific execution environment as an option of the software program. In this example, the utility program or the software program itself may identify the privilege status of the software program.

At step304, one or more of the systems described herein may establish the program-specific execution environment by determining that one or more processes executing on the client system are not essential to operation of the privileged software program to be executed on the client system, and, in response to identifying the non-essential process, suspending execution of the non-essential process. For example, determination module106may, as part of client system202inFIG. 2, determine that one or more processes executing on client system202are not essential to operation of software program208to be executed on client system202.

The term “essential,” as used herein, generally refers to membership in a restricted set of processes relied upon to support execution of a specific privileged software program on a computing device. An essential process may support execution of a privileged software program in any of a variety of ways. For example, an essential process may support execution of a privileged software program by providing one or more services and/or functions for the privileged software program. In some examples, the essential process may improve the functioning of the privileged software program in terms of performance, functionality, stability, and/or security. By extension, the set of the software components, such as processes, libraries, and drivers, needed to support execution of essential processes on the computing device may also be considered essential. Examples of essential processes may include function libraries invoked, directly or indirectly, by the privileged software program and operating system subsystems and drivers that support privileged software program functions.

The term “non-essential,” as used herein, generally refers to processes and associated software components not belonging to the restricted set relied upon to support execution of the privileged software program on the computing device. Accordingly, in some examples, each process and/or software component absent from a whitelist and/or dependency structure that defines the restricted set may be regarded as “non-essential.” Thus, in some examples non-essential processes may include both harmful and benign processes, and identifying a process as non-essential may not involve making a specific determination that the non-essential process would adversely affect the privileged software program. Examples of non-essential processes may include processes detrimental to operations of the privileged software program, such as malware or resource-intensive processes that may degrade performance of the privileged software program, or processes that may modify the display mode of the computing device, obscure a portion of the privileged software program display, or distract the privileged software program user, such as program updaters or messaging programs. Non-essential processes may also include processes unrelated to the privileged software program or with no known impact on operations of the privileged software program, but which are simply not needed to support execution of the privileged software program on the computing device.

Determination module106may determine that one or more executing processes are non-essential in a variety of ways. For example, determination module106may determine that the process is not essential to operation of the privileged software program by querying a process dependency database. As shown inFIG. 2, determination module106may query process dependency database120using a unique identifier for software program208. For example, determination module106may perform a hash function on the executable file for software program208to obtain a unique identifier associated with software program208to be used when querying process dependency database120. In response to querying process dependency database120, determination module106may receive an indication that the process is not essential to operation of privileged software program208.

In another example, determination module106may determine that one or more executing processes are non-essential based on configuration information provided by an administrator. For example, an administrator may create a list of processes and/or operating system functions software program208requires to operate. Determination module106may then determine that other executing processes are non-essential.

Also at step304inFIG. 3, after determining that one or more executing processes are non-essential, one or more of the systems described herein may, in response to identifying the non-essential process, suspend execution of the non-essential process. For example, control module108may, as part of client system202inFIG. 2, in response to identifying non-essential process210, suspend execution of non-essential process210. Once non-essential processes have been identified and suspended, the systems described herein have established program-specific execution environment212.

Control module108may suspend execution of non-essential process210in a variety of ways. For example, control module108use an application programming interface (API) of the client system's operating system to suspend the process. MICROSOFT WINDOWS provides several APIs that suspend and resume execution of a process, such as DebugActiveProcess and DebugActiveProcessStop. A program running on LINUX may issue SIGINT and SIGCONT signals to suspend and resume execution of a process.

In some examples, control module108may suspend execution of the non-essential process by intercepting an entry point of the process. Control module108may intercept a function or event handler at an entry point. Control module108may then determine whether to terminate execution or allow process execution to continue, based on the calling process, function parameters, etc. Control module108may use this approach to advantage with a function library that must remain in memory to make some library functions available while blocking access to other library functions.

In one embodiment, systems described herein may intercept an attempt to initiate a new process not yet executing on the client system and determine whether the new process is essential to operation of the privileged software program. For example, control module108may use an operating system API to be notified when a process start event initiates execution of a new process. Control module108may then determine whether the new process is essential or non-essential. If the process is non-essential, control module108may suspend or terminate execution of the process.

FIG. 4is a block diagram of example system400for creating program-specific execution environments. As illustrated in this figure, example system400may include components of system200inFIG. 2, such as client system202, memory140, modules102and software program208. Example system400may also include several non-essential processes, suspended using the techniques described above. For example, system400may include suspended processes402, including non-essential processes404(1)-404(3). System400may also include replaced programs406, which may include non-essential process404(4). Modules102may have replaced non-essential process404(4) with replacement process408. Example system400may also include blocked programs410, which may include non-essential processes404(5) and404(6). After modules102establish the program-specific execution environment by suspending the non-essential processes404enumerated above, modules102may initiate software program208, which may include function412(1) and function412(2). When initiating software program208, modules102may block functions not essential to performing a particular task, such as blocked function414. Modules102may maintain data structures similar to those represented by suspended processes402, replaced programs406, and blocked programs410, so that modules102may resume execution of the suspended processes and programs when software program208exits.

At step306, one or more of the systems described herein may initiate execution of the privileged software program in the program-specific execution environment. For example, initiation module110may, as part of client system202inFIG. 2, initiate execution of software program208in program-specific execution environment212.

Initiation module110may initiate execution of software program208in a variety of ways. For example, initiation module110may inform the user that the program-specific execution environment has been established and allow the user to execute the privileged software program. Initiation module110may then monitor the privileged software program until termination, so that execution of processes suspended while establishing the program-specific execution environment may be resumed. In another example, initiation module110may launch the privileged software program programmatically using an operating system API.

In one embodiment, systems described herein may identify one or more tasks to be performed by the privileged software program and a set of software program functions essential to performing the task. For example, initiation module110may, as part of client system202inFIG. 2, identify a task to be performed by software program208. For example, a user or administrator may specify that when a web browser is executing a browser-based banking application only browser functions that directly support the banking application may be permitted to execute. Initiation module110may determine the essential functions by querying process dependency database120, or an administrator may specify the essential functions. Control module108may then assure that only the functions essential to performing the specified task are permitted to execute by preventing software program208from performing functions not included in the set of essential functions.

In some examples, control module108may prevent the privileged software program from performing at least one function not included in the set of essential functions by preventing the privileged software program from initiating a process. In the example of the browser-based banking application described above, control module108may prevent the browser from initiating additional browser sessions or opening windows not related to the banking application. In some examples, control module108may allow the privileged software program to fork and/or create new processes and/or threads for executing the privileged software program but may disallow the privileged software program from initiating processes that are not designated as essential processes.

In one embodiment, systems described herein may include identifying one or more processes executing on the client system that perform functions essential to operation of the privileged software program and one or more functions not essential to operation of the privileged software program. Systems described herein may then initiate a replacement process that performs the essential function but does not perform the non-essential function. For example, determination module106may, as part of client system202inFIG. 2, identify an operating system component, such as a device driver or function library that provides several functions, some of which are essential and others non-essential. Control module108may disable the component by blocking, bypassing, or unloading it from memory and replace the component with a replacement component that provides the same essential functions, but not the non-essential functions. The systems described herein may use this approach to temporarily replace a device driver that performs one or more non-essential or unwanted functions.

As explained above in connection with example method300inFIG. 3, the systems and methods described herein may establish a program-specific execution environment, or “soft safe mode” that protects a privileged software program from interruption by program updaters or security breaches by malware or adware. By suspending non-essential user- and kernel-mode components, most computing system resources may be dedicated to the privileged software program. When the privileged software program exits or a specific task is completed, the systems and methods described herein may dismantle the program-specific execution environment and restore the computing system to its prior state by resuming execution of any suspended processes.

As part of establishing and maintaining the program-specific execution environment, the systems and methods described herein may suspend non-essential user applications and/or kernel drivers. In addition, once the systems and methods described herein have established the program-specific execution environment, the disclosed systems and methods may block or suspend execution of any new applications and/or processes that begin executing. The disclosed systems and methods may also limit the functionality of the privileged software program to functions essential to performing a specific task and/or may block the software program from spawning additional processes.

In some examples, system memory516may store and/or load an operating system540for execution by processor514. In one example, operating system540may include and/or represent software that manages computer hardware and software resources and/or provides common services to computer programs and/or applications on computing system510. Examples of operating system540include, without limitation, LINUX, JUNOS, MICROSOFT WINDOWS, WINDOWS MOBILE, MAC OS, APPLE'S10S, UNIX, GOOGLE CHROME OS, GOOGLE'S ANDROID, SOLARIS, variations of one or more of the same, and/or any other suitable operating system.

In certain embodiments, example computing system510may also include one or more components or elements in addition to processor514and system memory516. For example, as illustrated inFIG. 5, computing system510may include a memory controller518, an Input/Output (I/O) controller520, and a communication interface522, each of which may be interconnected via a communication infrastructure512. Communication infrastructure512generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of communication infrastructure512include, without limitation, a communication bus (such as an Industry Standard Architecture (ISA), Peripheral Component Interconnect (PCI), PCI Express (PCIe), or similar bus) and a network.

As illustrated inFIG. 5, computing system510may also include at least one display device524coupled to I/O controller520via a display adapter526. Display device524generally represents any type or form of device capable of visually displaying information forwarded by display adapter526. Similarly, display adapter526generally represents any type or form of device configured to forward graphics, text, and other data from communication infrastructure512(or from a frame buffer, as known in the art) for display on display device524.

As illustrated inFIG. 5, example computing system510may also include at least one input device528coupled to I/O controller520via an input interface530. Input device528generally represents any type or form of input device capable of providing input, either computer or human generated, to example computing system510. Examples of input device528include, without limitation, a keyboard, a pointing device, a speech recognition device, variations or combinations of one or more of the same, and/or any other input device.

Additionally or alternatively, example computing system510may include additional I/O devices. For example, example computing system510may include I/O device536. In this example, I/O device536may include and/or represent a user interface that facilitates human interaction with computing system510. Examples of I/O device536include, without limitation, a computer mouse, a keyboard, a monitor, a printer, a modem, a camera, a scanner, a microphone, a touchscreen device, variations or combinations of one or more of the same, and/or any other I/O device.

In certain embodiments, communication interface522may also represent a host adapter configured to facilitate communication between computing system510and one or more additional network or storage devices via an external bus or communications channel. Examples of host adapters include, without limitation, Small Computer System Interface (SCSI) host adapters, Universal Serial Bus (USB) host adapters, Institute of Electrical and Electronics Engineers (IEEE) 1394 host adapters, Advanced Technology Attachment (ATA), Parallel ATA (PATA), Serial ATA (SATA), and External SATA (eSATA) host adapters, Fibre Channel interface adapters, Ethernet adapters, or the like. Communication interface522may also allow computing system510to engage in distributed or remote computing. For example, communication interface522may receive instructions from a remote device or send instructions to a remote device for execution.

In some examples, system memory516may store and/or load a network communication program538for execution by processor514. In one example, network communication program538may include and/or represent software that enables computing system510to establish a network connection542with another computing system (not illustrated inFIG. 5) and/or communicate with the other computing system by way of communication interface522. In this example, network communication program538may direct the flow of outgoing traffic that is sent to the other computing system via network connection542. Additionally or alternatively, network communication program538may direct the processing of incoming traffic that is received from the other computing system via network connection542in connection with processor514.

Although not illustrated in this way inFIG. 5, network communication program538may alternatively be stored and/or loaded in communication interface522. For example, network communication program538may include and/or represent at least a portion of software and/or firmware that is executed by a processor and/or Application Specific Integrated Circuit (ASIC) incorporated in communication interface522.

FIG. 6is a block diagram of an example network architecture600in which client systems610,620, and630and servers640and645may be coupled to a network650. As detailed above, all or a portion of network architecture600may perform and/or be a means for performing, either alone or in combination with other elements, one or more of the steps disclosed herein (such as one or more of the steps illustrated inFIG. 3). All or a portion of network architecture600may also be used to perform and/or be a means for performing other steps and features set forth in the instant disclosure.

Client systems610,620, and630generally represent any type or form of computing device or system, such as example computing system510inFIG. 5. Similarly, servers640and645generally represent computing devices or systems, such as application servers or database servers, configured to provide various database services and/or run certain software applications. Network650generally represents any telecommunication or computer network including, for example, an intranet, a WAN, a LAN, a PAN, or the Internet. In one example, client systems610,620, and/or630and/or servers640and/or645may include all or a portion of system100fromFIG. 1.

As illustrated inFIG. 6, one or more storage devices660(1)-(N) may be directly attached to server640. Similarly, one or more storage devices670(1)-(N) may be directly attached to server645. Storage devices660(1)-(N) and storage devices670(1)-(N) generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. In certain embodiments, storage devices660(1)-(N) and storage devices670(1)-(N) may represent Network-Attached Storage (NAS) devices configured to communicate with servers640and645using various protocols, such as Network File System (NFS), Server Message Block (SMB), or Common Internet File System (CIFS).

In addition, one or more of the modules described herein may transform data, physical devices, and/or representations of physical devices from one form to another. For example, one or more of the modules recited herein may receive process and process dependency data to be transformed, transform the data, output a result of the transformation to identify one or more non-essential processes, use the result of the transformation to create a program-specific execution environment by suspending the non-essential processes, and initiating execution of a privileged software program, and store the result of the transformation to resume execution of the suspended processes when the privileged software program terminates. Additionally or alternatively, one or more of the modules recited herein may transform a processor, volatile memory, non-volatile memory, and/or any other portion of a physical computing device from one form to another by executing on the computing device, storing data on the computing device, and/or otherwise interacting with the computing device.