Patent ID: 8407757

Claim:
A method of specifying and enforcing run-time policies for application processes being executed on a computer, comprising: relating a run-time policy with an executable file of an application process to be executed on a computer; tracking access by said application process to a computer resource selected from the group consisting of: a file system, the computer's system configuration, and the computer's network stack, wherein said tracking is performed using a kernel-mode monitor; in response to said application process: 1) initializing, 2) executing, and 3) performing a first access from the computer's user mode to one of said computer resources, retrieving and returning said run-time policy to the kernel-mode monitor; associating said run-time policy with said application process; and enforcing said run-time policy on said application process using the kernel-mode monitor thereby resulting in each running instance of said application process being maintained, wherein using the kernel-mode monitor for said enforcing comprises: classifying said application process as running under a classified run-time policy, enforcing the retrieved run-time policy on the access that had been detected by the kernel-mode monitor, and enforcing the retrieved run-time policy on at least one subsequent operation performed by said application process.