Patent ID: 7673109

Claim:
In a computerized environment including one or more application programs that may or may not be trusted, and an operating system having one or more type data structures, a method of restricting access by the one or more application programs to the one or more type data structures, comprising the acts of: executing one or more application programs in a lower-privilege mode in a first address space associated with one set of permissions; receiving one or more requests from the one or more application programs for type information corresponding to one or more type data structures in a memory location; processing the one or more requests in order to validate at least one request via one or more kernel mode components operating in a second address space associated with a different set of permissions; for the validated request, passing type information corresponding to the validated request into a shared memory heap, wherein the one or more application programs can access the type information without accessing the type data structures of the operating system; and for the validated request, passing a value that is accessible to the one or more application programs, wherein the value is associated with the type information in the shared memory heap.