Computer system protection

A computer system for receiving potentially harmful incoming data from an external source, the computer system including

• a) a sandbox application for receiving data and defining a sandbox desktop,
• b) checking means for:
• i) receiving incoming data and in such data distinguishing harmless data from suspect data,
• ii) passing on the harmless data for processing with an application associated with a main desktop of the computer system, and
• iii) sending the suspect data for encryption,
• c) encrypting means for receiving the suspect data from the checking means and encrypting the suspect data to transform it to encrypted data and thereby render it harmless,
• d) decrypting means arranged to decrypt the encrypted data to transform it to decrypted data, and
• e) a constrained application constrained by the sandbox application arranged to process the decrypted data.

A method for protecting a computer system against potentially harmful incoming data from an external source, the computer system including a sandbox application for receiving data and defining a sandbox desktop, and means for decrypting data, and the method incorporating the steps of:

• a) distinguishing harmless data from suspect data in the incoming data,
• b) passing on the harmless data for processing with an application associated with a main desktop of the computer system,
• c) encrypting the suspect data to transform it into harmless encrypted data,
• d) decrypting the encrypted data to transform it into decrypted data, and
• e) processing the decrypted data by means of a constrained application constrained by the sandbox application.

A method of protecting a computer system against potentially harmful incoming data from an external source, the computer system including a sandbox application for receiving data and defining a sandbox desktop, and decrypting means for decrypting data, and the method incorporating the steps of:

• a) checking incoming data to distinguish therein harmless data from suspect data,
• b) passing on data deemed to be harmless data for processing with an application associated with a main desktop of the computer system,
• c) encrypting data deemed to be suspect data to transform it to encrypted data and thereby render it harmless,
• d) decrypting the encrypted data to transform it to decrypted data for receipt by the sandbox application, and
• e) processing the decrypted data with a constrained application constrained by the sandbox application.

A computer readable medium having program code recorded thereon for protecting a computer system against potentially harmful incoming data received from an external source, the program code including decrypting code for decrypting data and a sandbox application for receiving data and defining a sandbox desktop, and the program code being for execution of a method comprising:

• a) distinguishing harmless data from suspect data in the incoming data,
• b) passing on the harmless data for processing with an application associated with a main desktop of the computer system,
• c) encrypting the suspect data to transform it to encrypted data and thereby render it harmless,
• d) decrypting the encrypted data to transform it to decrypted data, and
• e) processing the decrypted data using a constrained application constrained by the sandbox application.

A computer readable medium having program code recorded thereon for protecting a computer system against potentially harmful incoming data received from an external source, the program code including decrypting code for decrypting data and a sandbox application for receiving data and defining a sandbox desktop, and the program code being for execution of a method comprising:

• a) checking incoming data and deeming it harmless data or suspect data,
• b) passing on data deemed harmless data for processing with an application associated with a main desktop of the computer system,
• c) encrypting data deemed suspect data to transform it to encrypted data and thereby render it harmless,
• d) decrypting the encrypted data to transform it to decrypted data for receipt by the sandbox application, and
• e) processing the decrypted data with a constrained application constrained by the sandbox application.