Patent ID: 7756893

Claim:
A method comprising: implementing an independent computation environment contained at least in part in one or more hardware components of a computing device; and implementing a policy engine within the independent computation environment, the policy engine comprising a communication interface and the policy engine executable to: authenticate code of an executable module based on examining metadata of the executable module, the metadata specifying statistics that indicate authenticity of the executable module, and the statistics are related to counting execution of binary instructions during execution of the executable module, according to an execution policy, to manage the execution of the executable module in relation to one or more memory addresses of the computing device that are referenced by the metadata of the executable module, and the policy engine manages the execution of the executable module in relation to the one or more memory addresses by communicating via the communication interface, according to the execution policy, to allow access to the one or more memory addresses and to prevent access to the one or more memory addresses, and the execution policy specifying that code of the executable module is absent from the one or more memory addresses of the computing device that are referenced by the metadata during a first time period and that the policy engine measures the statistics related to the execution of the executable module during a second time period; store data related to the execution of the executable module in the one or more memory addresses referenced by the metadata during the execution of the executable module and avoid storing the data related to the execution of the executable module in another memory address not specified by the metadata; and manage the execution of the executable module by monitoring status bits of the executable module that are stored in one or more data registers referenced by the metadata.