Patent ID: 8352797

Claim:
A computer-implemented method of running an extensible software system comprising, on a computing system: running a host portion of the software system in a first domain; running at least one extension to the software system in a second domain, the extension comprising an untrusted extension instrumented to include at least one access right check; storing access control data for substantially each byte of relevant virtual address space comprising: storing a first data structure comprising access right data associated with substantially each memory slot, a memory slot comprising a fixed number of bytes of relevant virtual address space; storing a second data structure comprising access right data associated with each byte of virtual address space in at least one memory slot; mediating calls between the first domain and the second domain using an interposition library comprising a plurality of wrappers for functions; and checking access rights before a write operation using the access control data comprising: using the first data structure to obtain access right data for a memory slot comprising a byte of virtual address space to be written; and if the access right data obtained using the first data structure indicates a conflict, using the second data structure to obtain access right data for the byte of virtual address space to be written.