Patent ID: 8078740

Claim:
A computer-implemented method comprising: launching an Internet-application that inherits privileges of a token associated with a user, the token including a user integrity level associated with the user; providing a blocking mechanism that is configured to block the Internet-application's access to defined spaces of a client computing device on which the Internet-application executes, the defined spaces including an administrative space and a user space of the client computing device, and the providing a blocking mechanism comprising: setting an administrative space integrity level that is higher than the user integrity level to restrict the Internet-application from accessing the administrative space; setting a user space integrity level that is higher than the user integrity level to restrict the Internet-application from accessing the user space; defining a containment zone in which the Internet-application is to write and read data; setting a containment zone integrity level that is lower than or equal to the user integrity level to allow the Internet-application to access the containment zone; launching, as a result of the user's interaction with the Internet-application, an unrestricted Internet-application that is unblocked by the blocking mechanism, the unrestricted Internet-application associated with an additional token that is configured to enable the unrestricted Internet-application to access the administrative space and the user space; and defining an additional containment zone in which the unrestricted Internet-application is to read and write data, the Internet-application being restricted from accessing the additional containment zone and the unrestricted Internet-application being restricted from accessing the containment zone.