Patent ID: 8005959

Claim:
A method of providing security sessions within an operating system executed on a computing device, the method comprising: initiating, during a boot process of the operating system on the computing device, a first session configured to contain execution of one or more high-privileged operating system services and data that are to be processed or have been processed by the one or more non-interactive operating system services, the first security session being managed by a session manager module executed within the operating system, wherein the high-privileged operating system services are non-interactive services executed in the operating system without user interaction; receiving a request, by the operating system executed on the computing device, to initiate execution of a low-privileged user-interactive application within the operating system, the low-privileged user-interactive application being prone to being utilized by a malicious user for compromising security of the operating system, the compromising comprising using malicious code to elevate security privilege of the user-interactive application during the user interaction and attacking the one or more high-privileged operating system services in the operating system; determining, at the session manager module of the operating system, the low-privileged user-interactive application is to be created and executed in a second session based on one or more security considerations for execution of the application; and initiating, via the session manager module, the second session within the operating system, the second session being separate from the first session and being configured to contain execution of the low-privileged user-interactive application and data related to the user-interactive application, wherein the first session and the second session are managed by the session manager module to include a respective portion of memory to store data for processing and as a result of processing performed within the respective sessions; and wherein the first session and the second session are configured for security functionality in that: services, applications and data within a session are accessible by other applications and services within that session; the one or more high-privileged operating system services and the data within the first session are not directly accessible to the low-privileged user-interactive application within the second session; and the low-privileged user interactive application and the data within the second session are not directly accessible to the one or more high-privileged operating system services such that, in an event that security of the low-privileged user-interactive application in the second session is compromised by a malicious attack, the one or more high-privileged operating system services in the first session are not exposed to the malicious attack due to isolation of the first session and the second session in the operating system.