Patent ID: 7757291

Claim:
In a computer platform for executing a first software application and second software applications, wherein the computer platform includes a processor, an operating system (OS) including a kernel residing on the computer platform, and a set of associated system objects included within an OS-defined system object namespace, a method for isolating effects of malware within a contained capsule environment when said malware is loaded via the first software application onto the computer platform, the method comprising the steps of: a) providing within the contained capsule environment a capsule object namespace that is distinct from the OS-defined system object namespace and accessible by the first software application and processes originated therefrom; b) providing a capsule object set in the application-specific capsule object namespace, the capsule object set including: i. a set of associated capsule-related system objects for use by the first software application and any process originated therefrom in place of at least some of the associated system objects that are resident on the computer platform as part of the OS and are required for execution of the first software application, wherein said set of associated capsule-related system objects is not for use by the second software applications; and, ii. capsule runtime software for managing a dynamic state and file location of the first software application, the capsule runtime software including at least one additional application library resident in user mode; c) providing a kernel module for supporting the capsule runtime software in kernel mode; wherein in operation the first software application and the second software applications utilize services of the same OS kernel residing on the computer platform; and, wherein the capsule runtime software provides system-service filters for dynamically filtering system service requests generated by the first software application or by a process originated therefrom for one or more application related system objects required by the first software application, and providing in response to said requests one or more corresponding application related system objects from the set of associated capsule-related system objects from the protected capsule-related object namespace, so as to contain malware-related system object changes and objects created by the first application, or any process originated therefrom, within the protected capsule-related object namespace, and to prevent the malware from changing system objects of the operating system.