Patent ID: 8353031

Claim:
A computer system comprising: a computer processor; and a computer-readable storage medium storing computer program instructions, the computer program instructions when executed by the computer processor perform steps comprising: enabling a virtualization environment to be run on the computer system; verifying that a security environment within the virtualization environment and a virtual security appliance within the security environment have not been tampered with, the virtual security appliance within a service operating system that executes in a security virtual machine of the security environment; and running the virtual security appliance in the security environment responsive to the verification; generating a user environment within the virtualization environment that is segregated from the security environment, the user environment comprising a user operating system that executes in a user virtual machine within the user environment, the user environment adapted to execute a user application within the user environment and execute the user operating system within the user environment responsive to the virtual security appliance running in the security environment; and using the virtual security appliance to: intercept network traffic directed to the user application in the user environment; analyze the intercepted network traffic; identify a security threat in the intercepted network traffic; isolate the security threat from the intercepted network traffic to yield filtered network traffic; and transmit the filtered network traffic to the user application in the user environment.