Patent ID: 7984514

Claim:
A method comprising: identifying a computer application at a computer system, the computer system including local storage and being communicatively coupled to a network; determining a set of actions performable by the computer application, the determined set of actions including at least a combination of read-accessing the local storage and transmitting to the network, said determining comprising receiving a declaration from the computer application, wherein the declaration includes the set of actions; responsive to said determined set of actions, assigning said computer application a set of restrictions against access to select ones of a plurality of system functions, the set of restrictions including disallowing the computer application access to at least one of read-access to the local storage and transmission to the network, said assigning comprising determining other non-secure combinations of the set of actions in addition to the combination of said read-accessing the local storage and said transmitting to the network, selecting other ones of the plurality of system functions that enable the other non-secure combinations, and creating the set of restrictions responsive to said selecting; monitoring execution of said computer application; prohibiting said computer application from accessing said select ones of said plurality of system functions within said set of restrictions; receiving another declaration from the computer application, wherein the other declaration includes one or more actions within the set of restrictions; and responsive to said receiving the other declaration, either ceasing execution of the computer application or rejecting the other declaration.