TRESOR Runs Encryption Securely Outside RAM
Copilot - a coprocessor-based kernel runtime integrity monitor