A secured Windows® OS electronic computer system having a software based isolated User environment protected from unauthorized access to and manipulation of data, the software providing an isolated User file system, process/IPC isolation, Windows® registry isolation, network interface isolation, and isolated administrative control and comprising:
- an execution hook component that traps system calls requesting process execution and initiates creation of User isolated environment and manages assignment of successive process execution requests to the appropriate method of execution, providing appropriate isolated process execution control, trapping all calls to load an executable image, testing execution requests for an assigned User context, processing execution requests without a User context by either assigning an administrative context and passing them on for processing in the manner native to a Host computer system or assigning a User context by interrogating the environment handler for User authentication and credentials etc, triggering requests to the environment handler upon new User context assignments to create a new User environment including isolated file system, network connectivity, Windows registry hive and execution environment to which to bind the current requested process and all subsequent processes with User context, assigning process execution requests with existing User context to their associated User specific job object, the hook component filtering based on appropriate metadata described by the software and environment handler;
- a job object component, the job object component creating/destructing, managing and manipulating job objects, providing an alternative process creation mechanism to that native to the Host computer system by starting User processes in a restricted state, implementing User credential based security descriptors to define restrictions to User processes, providing isolated process/IPC and memory control based on appropriate metadata described by the software and the environment handler;
- a system call hook component trapping and filtering all Windows registry I/O requests to facilitate file system and memory isolating, filtering calls based on their User context and redirecting User registry I/O requests to User isolated file system, processing User specific credentials prescribed by the environment handler for defining what registry hives or keys or subset thereof will be abstracted from Host computer systems native registry, system call hook component filtering based on appropriate metadata described by the software and environment handler;
- a file system block device driver component for mounting/unmounting the isolated User file system to facilitate isolating the file system;
- a file system/filter driver component filtering all file system I/O requests to accomplish file system isolation, redirecting file system I/O requests associated with User context to User file system, providing granular proxy of all I/O facilitating the redirection of all or some subset of I/O based on request type, requested file system, object credentials or type, filtering based on appropriate metadata described by the software and environment handler;
- a network interface/NDIS hook component, for abstracting User network interface from Host computer system's network interface, providing bridging, packet filtering and other services typical of network interface control based on metadata described by the software and environment handler;
- and
- an environment handler providing environment management services for all software components, revealing an administrative configuration interface allowing the definition of rules and general configuration data, managing and defining User authentication and credentials for all the software components, prescribing filter metadata and periodically obtaining log statistics from the software components, revealing controls typical of software management systems, in combination providing the secured, non-reversible, isolated user environment software having said isolated user file system, process/IPC isolation, Windows registry isolation, network interface isolation, and isolated administrative control.