Patent ID: 8528083

Claim:
A method performed by a computing system, the method comprising: receiving a request from an application to enable a secure sandbox; responsive to receiving the request, adding a call gate descriptor for a call gate to a segment descriptor table for the application, the call gate descriptor configured to specify: a first privilege level of the application, the first privilege level associated with the call gate; and a second privilege level requested by the call gate, the second privilege level being relatively higher than the first privilege level; providing a call gate selector for the call gate descriptor to the application in response to the request; receiving a far call from the application, the far call having a segment selector that references the call gate descriptor; and responsive to receiving the far call: transitioning into the second privilege level; switching into the call gate target code based on the segment selector; enabling selective redirection by at least executing the call gate target code; and returning control to the application responsive to the selective redirection being enabled.