Patent ID: 7690033

Claim:
A method for securing a computer system, comprising: monitoring an operating system executing on a processor in the computer system; trapping, in response to the monitoring, a process system call to execute a program, wherein the process system call originated in a host executing in the computer system; responsive to the trapping: determining whether the process system call is associated with a user context; in response to determining that there is no user context associated with the process system call creating the user context for a user that initiated the process system call, creating an isolated user environment (IUE) in the computer system, and binding the user context to the IUE, wherein, after the binding, subsequent requests associated with the user context are restricted by the IUE, wherein creating the IUE comprises: allocating memory and persistent storage for the IUE in the computer system, creating a user job object associated with the user and comprising security descriptors, wherein the user job object is associated with the IUE, wherein user processes associated with the user job object are restricted by the IUE based on the security descriptors, exporting a virtual adaptor from the IUE to the host, wherein the virtual adaptor is associated with a Media Access Control (MAC) address and an Internet Protocol (IP) address; and wherein the IUE is associated with: a file system filter driver (FSFD) configured to redirect Input/Output (I/O) calls originating from the IUE to the persistent storage, and a network interface/NDIS hook component configured to control, using the virtual adapter, network traffic originating from the IUE to network devices external to the host and destined for the IUE from network devices external to the host; after creating the IUE, loading an executable image corresponding to the program into the IUE; and executing the program using the executable image in the IUE using the processor, wherein the IUE enables a user to provide input to the program during execution, wherein a user process executing the program is associated with the user job object, wherein execution of the program is restricted based in part on the user job object, and wherein during execution of the program in the IUE at least one packet is sent, using the virtual adaptor, from the IUE to a network device external to the host.