Electronic computer system secured from unauthorized access to and manipulation of data

1. A method for securing a computer system, comprising:

monitoring an operating system executing on a processor in the computer system;

trapping, in response to the monitoring, a process system call to execute a program, wherein the process system call originated in a host executing in the computer system;

responsive to the trapping:

determining whether the process system call is associated with a user context;

in response to determining that there is no user context associated with the process system call creating the user context for a user that initiated the process system call, creating an isolated user environment (IUE) in the computer system, and binding the user context to the IUE, wherein, after the binding, subsequent requests associated with the user context are restricted by the IUE,

wherein creating the IUE comprises:

allocating memory and persistent storage for the IUE in the computer system,

creating a user job object associated with the user and comprising security descriptors, wherein the user job object is associated with the IUE, wherein user processes associated with the user job object are restricted by the IUE based on the security descriptors,

exporting a virtual adaptor from the IUE to the host, wherein the virtual adaptor is associated with a Media Access Control (MAC) address and an Internet Protocol (IP) address; and

wherein the IUE is associated with:

a file system filter driver (FSFD) configured to redirect Input/Output (I/O) calls originating from the IUE to the persistent storage, and

a network interface/NDIS hook component configured to control, using the virtual adapter, network traffic originating from the IUE to network devices external to the host and destined for the IUE from network devices external to the host;

after creating the IUE, loading an executable image corresponding to the program into the IUE; and

executing the program using the executable image in the IUE using the processor, wherein the IUE enables a user to provide input to the program during execution, wherein a user process executing the program is associated with the user job object, wherein execution of the program is restricted based in part on the user job object, and wherein during execution of the program in the IUE at least one packet is sent, using the virtual adaptor, from the IUE to a network device external to the host.

2. The method of claim 1 , further comprising:

responsive to the executing, issuing an I/O call from the IUE to a file system of the host; and

redirecting, by the FSFD, the I/O call to the persistent storage, wherein the persistent storage comprises a file system of the IUE.

3. The method of claim 2 , wherein a hierarchy of the file system of the IUE mirrors a hierarchy of the file system of the host.

4. The method of claim 2 , wherein the FSFD is configured to limit the portions of the file system of the host which processes executing in the IUE may access.

5. The method of claim 1 , further comprising:

responsive to the executing, issuing an I/O call from the IUE to a registry of the host; and

redirecting, by a system call hook component, the I/O call to the persistent storage, which includes a registry of the IUE.

6. The method of claim 5 , wherein the registry of the IUE is a mirror of the registry of the host.

7. The method of claim 5 , wherein the system call hook component is configured to query the registry of the IUE prior to querying the registry of the host when locating a registry key.

8. The method of claim 1 , further comprising:

responsive to the executing, storing data in the persistent storage;

after executing the process system call, closing the IUE; and

responsive to closing the IUE, terminating all processes executing the IUE, deallocating the memory and unmounting the persistent storage.

9. The method of claim 8 , further comprising:

creating a new IUE after closing the IUE, wherein the data in the persistent storage is accessible through the new IUE.

10. The method of claim 1 , wherein the process system call is associated with the user, wherein the persistent storage comprises a file system for the user and wherein the IUE comprises a file system block device driver component configured to mount and unmount the file system for the user.

11. The method of claim 10 , wherein the file system for the user is stored as a flat file in the persistent storage after the IUE is closed.

12. The method of claim 1 , wherein the process system call corresponds to a call to open a web browser and access a website external to the host via the web browser.

13. The method of claim 1 , wherein the host is associated with a first TCP/IP stack and the IUE is associated with a second TCP/IP stack, wherein the first TCP/IP stack is distinct from the second TCP/IP stack.

14. The method of claim 1 , wherein the process system call is associated with the user job object and wherein job objects not associated with the IUE are hidden from the restricted process.

15. The method of claim 1 , wherein the IP address associated with the virtual adapter is distinct from an IP address associated with a physical network interface connected to the host.