Patent ID: 7363493

Claim:
A process for protecting a computer from hostile code, the process comprising: defining at least two trust groups, each of the defined trust groups being characterized by a trust group values, a FromLower rules list pointer, and a ToLower rules list pointer; assigning objects and processes in the computer to one of said trust groups, irrespective of the rights of a user of said computer; defining at least two object types; defining a plurality of operation types; assigning an object type to each of the objects; defining a plurality of action rules, each of the action rules corresponding to at least one of the FromLower or ToLower rules list pointers, each of the action rules listing a combination of an operation type from the plurality of operation types; an action; and object type; and, upon an access request of an operation type by a request process to a target object, comparing the trust group value of the trust group of the process to the trust group value of the trust group of the object and: when the trust group value of the trust group of the process is higher than the trust group value of the trust group of the object, inspecting all action rules corresponding to the ToLower action rules list pointer of the trust group of the process to obtain a matching action rule listing the same operation type of the access request and the same object type of the target object and, once a matching action rule is obtained, performing the action indicated by the matching action rule; and when the trust group value of the trust group of the process is smaller than the trust group value of the trust group of the object, inspecting all action rules corresponding to the FromLower action rules list pointer of the trust group of the object to obtain a matching action rule listing the same operation type of the access request and the same object type of the target object and once a matching action rule is obtained performing the action indicated by the matching action rule.