A method implemented in a computer comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method characterised as comprising: creating a template system call page table, the template system call page table comprising mappings of kernel code and data required to perform an entry to a kernel mode upon execution of a system call, a table with pointers to a set of system call handlers, and entry code of each system call handler in an entry page table of an operational system call page table, a populated kernel entry page table and an empty user-space page table; in response to a user-space process being created, copying the template system call page table to create the operational system call page table for the user-space process in a process state representation and populating the empty user-space table of the operational system call page table with user-space mappings in the same way as a normal process page table, wherein the operational system call page table comprises a plurality of kernel-space address ranges allowing execution of kernel code and access to kernel data; executing a system call, by the user-space process; when the user-space process makes the system call, switching to kernel mode and invoking a generic system call entry routine, the invoking switching a page table pointer register to use the operational system call page table and to execute a system call handler of the operational system call page table; in response to the system call handler accessing memory comprising kernel-space kernel code and/or data, generating a page fault; verifying, by a security block, whether the requested memory access is allowed; in response to the access being determined to be allowed, adding a mapping of the requested memory to the operational system call page table; in response to execution of the system call handler ending, transferring control to the generic system call entry routine; cleaning up operational system call page table; and removing mappings added during the execution of the system call handler. creating a template system call page table, the template system call page table comprising mappings of kernel code and data required to perform an entry to a kernel mode upon execution of a system call, a table with pointers to a set of system call handlers, and entry code of each system call handler in an entry page table of an operational system call page table, a populated kernel entry page table and an empty user-space page table; in response to a user-space process being created, copying the template system call page table to create the operational system call page table for the user-space process in a process state representation and populating the empty user-space table of the operational system call page table with user-space mappings in the same way as a normal process page table, wherein the operational system call page table comprises a plurality of kernel-space address ranges allowing execution of kernel code and access to kernel data; executing a system call, by the user-space process; when the user-space process makes the system call, switching to kernel mode and invoking a generic system call entry routine, the invoking switching a page table pointer register to use the operational system call page table and to execute a system call handler of the operational system call page table; in response to the system call handler accessing memory comprising kernel-space kernel code and/or data, generating a page fault; verifying, by a security block, whether the requested memory access is allowed; in response to the access being determined to be allowed, adding a mapping of the requested memory to the operational system call page table; in response to execution of the system call handler ending, transferring control to the generic system call entry routine; cleaning up operational system call page table; and removing mappings added during the execution of the system call handler.