Patent ID: 8832389

Claim:
A method comprising: determining that a plurality of domains are associated with a first process in response to the first process requesting an operating system instance for access to a portion of a physical memory space, wherein each of the plurality of domains represents an organizational entity and the portion of the physical memory space is represented by at least a memory address; selecting a portion of the physical memory space that is not designated for a domain according to a plurality of domain isolation rules; adding an additional domain isolation rule to the plurality of domain isolation rules indicating that the plurality of domains are identified as allowable domains for the portion of the physical memory space, wherein the additional domain isolation rule further requires that a requesting process be associated with each of the plurality of domains for the portion of the physical memory space to be allocated to the requesting process; allocating the portion of the physical memory space to the first process; determining that a second process is associated with a first of the plurality of domains responsive to an attempt by the operating system instance to give the second process access to the portions of the physical memory space; selecting the additional domain isolation rule indicating that the plurality of domains are identified as allowable domains for the portion of the physical memory space; determining that the additional domain isolation rule requires that the second process be associated with each of the plurality of domains; preventing the second from accessing the portion of the physical memory space based on the additional domain isolation rule.