Network isolation

A system comprising:

• an authorization device comprising a first processor, the first processor configured to:
• receive authentication credentials from a sandboxed computing environment operating via a second memory space on a host computer system on a network, the sandboxed computing environment using a host operating system and being isolated from a workspace operating via a first memory space using an internal isolation firewall, the workspace being associated with the host operating system of the host computer system;
• and
• authenticate the sandboxed computing environment of the host computer system using the received authentication credentials;
• and
• a proxy device comprising a second processor, the second processor configured to:
• receive, from a first application or process operating in the authenticated sandboxed computing environment of the host computer system, a first request to communicate with a first untrusted network destination;
• allow the first application or process operating in the authenticated sandboxed computing environment to communicate with the first untrusted network destination;
• receive, from a second application or process operating on the workspace of the host computer system, a second request to communicate with a second untrusted network destination;
• and
• prevent the second application or process operating on the workspace of the host computer system from communicating with the second untrusted network destination.

An Internet isolation system comprising:

• a host computer system comprising a first processor configured to:
• prevent, using a host-based firewall, communication and data transfer to another host computing system,
• implement a host operating system and a sandboxed computing environment, the host operating system configured to enable operation of a workspace that is configured to enable operation of a first set of one or more applications or processes via a first memory space, the sandboxed computing environment that uses the host operating system and is configured to enable operation of a second set of one or more applications or processes via a second memory space, and
• isolate, using an internal isolation firewall, the sandboxed computing environment that uses the host operating system from the workspace, and wherein the internal isolation firewall isolates the first memory space from the second memory space;
• an authorization device comprising a second processor configured to authenticate the sandboxed computing environment of the host computer system that uses the host operating system upon receipt of an authentication credential from the sandboxed computing environment;
• a proxy device comprising a third processor configured to:
• proxy communication between an untrusted network destination and the authenticated sandboxed computing environment, and
• prevent communication between the workspace of the host computer system and the untrusted network destination;
• and
• a border firewall configured to block an unauthorized communication between a network and the untrusted network destination.