Future Intel processors will support SGX (Software Guard Extensions), which allows running security-critical software on your processor in a way that is isolated from all the other code. The hardware provides secure isolation, so other code can't tamper with the security-critical code running in the SGX enclave. Even the OS kernel is not trusted and can't tamper with the code in the SGX enclave. The enclave itself is stateless, but there's a way it can save data on external storage securely: the hardware supports sealed storage, where data is encrypted and MAC'ed before being written to disk.
Are there any guarantees for freshness of sealed data? In other words, I'm worried about a rollback attack, where a malicious OS tries to roll the state of the enclave back to some earlier point in time: e.g., checkpoint the saved state, run the enclave for a while, then possibly restore back to the checkpoint. Can SGX code defend against such rollback attacks? If so, how?