Patent ID: 7757291
Filing Date: 2010-07-13
Classification: G06F

Abstract:
1. In a computer platform for executing a first software application and second software applications, wherein the computer platform includes a processor, an operating system (OS) including a kernel residing on the computer platform, and a set of associated system objects included within an OS-defined system object namespace, a method for isolating effects of malware within a contained capsule environment when said malware is loaded via the first software application onto the computer platform, the method comprising the steps of: wherein in operation the first software application and the second software applications utilize services of the same OS kernel residing on the computer platform; and, wherein the capsule runtime software provides system-service filters for dynamically filtering system service requests generated by the first software application or by a process originated therefrom for one or more application related system objects required by the first software application, and providing in response to said requests one or more corresponding application related system objects from the set of associated capsule-related system objects from the protected capsule-related object namespace, so as to contain malware-related system object changes and objects created by the first application, or any process originated therefrom, within the protected capsule-related object namespace, and to prevent the malware from changing system objects of the operating system.