CONTROL OF APPLICATION ACCESS TO SYSTEM RESOURCES

1 . A method of transferring a computer program product from at least one first computer to at least one second computer connected to the at least one first computer through a communication medium, the method comprising the steps of:

(a) accessing, on the at least one first computer, computer-executable instructions that, when executed in a system having a security mechanism that determines access by an application to system resources based on a security context in which the application is run, perform at least the steps of:

(1) running a first application subject to a first security context providing access to a first set of the system resources;

(2) receiving a request to run the first application subject to a second security context providing access to a second set of the system resources different from the first set; and

(2) running the first application subject to the second security context, wherein the application runs subject to the second security context without re-launching the application; and

(b) transferring the computer-executable instructions from the at least one first computer to the at least one second computer through the communications medium.

2 . The method of claim 1 wherein the first security context, with respect to the second security context, provides access to fewer of the system resources.

3 . The method of claim 1 wherein the second security context, with respect to the first security context, provides access to at least the same system resources.

4 . The method of claim 1 wherein at least one of the security contexts is defined by at least one privilege.

5 . The method of claim 1 wherein at least one of the security contexts is defined by at least one group identifier.

6 . The method of claim 1 wherein:

the first application includes a user interface; and

the computer-executable instructions further perform the step of displaying within the user interface a user-selectable field operable to enable the user to provide the request to run the first application subject to the second security context.

7 . A computer-readable medium having computer-executable instructions that, when executed in a system having a security mechanism that determines access by an application to system resources based on a security context in which the application is run, perform at least the steps of:

(a) providing a user interface that:

(1) enables a user to define a plurality of security contexts, each security context providing access to a respective set of the system resources; and

(2) enables the user to associate each application of a plurality of applications with a respective one of the security contexts; and

(b) running a first one of the applications subject to a first associated security context.

8 . The medium of claim 7 wherein the user interface further enables the user to define each set of the system resources.

9 . The medium of claim 7 wherein the computer-executable instructions further perform the step of running the first one of the applications subject to a second security context without re-launching the application.

10 . The medium of claim 7 wherein the user interface further enables the user to assign a processing priority to at least one of the security contexts.

11 . The medium of claim 7 wherein the user interface further enables the user to assign a memory allocation to at least one of the security contexts.

12 . The medium of claim 7 wherein the user interface further enables the user to apply a set of predetermined rules to at least one of the security contexts.

13 . The medium of claim 7 wherein the user interface further enables the user to apply a set of predetermined rules to at least one of the applications.

14 . The medium of claim 7 wherein the user interface further provides a representation of each security context in a respective portion of a display-device screen.

15 . The medium of claim 14 wherein the user interface further enables the user to associate an application with a security context by placing a graphical representation of the application in a screen portion associated with the security context.

16 . The medium of claim 15 wherein the user interface further enables the user to change the security context of an application by dragging a graphical representation of the application from a screen portion associated with a first security context and dropping the graphical representation in a screen portion associated with a second security context.

17 . A computer-readable medium having computer-executable instructions that, when executed in a system having a security mechanism that determines access by an application to system resources based on a security context in which the application is run, perform at least the steps of:

receiving definitions of a plurality of security contexts, each security context providing access to a respective set of the system resources;

receiving from the user an association of each application of a plurality of applications with a respective one of the security contexts; and

running a first one of the applications subject to a first associated security context.

18 . The medium of claim 17 wherein the computer-executable instructions further perform the step of running the first one of the applications subject to a second security context without re-launching the application.

19 . The medium of claim 17 wherein the computer-executable instructions further perform the step of enabling the user to apply a set of predetermined rules to at least one of the security contexts.

20 . The medium of claim 17 wherein the computer-executable instructions further perform the step of enabling the user to apply a set of predetermined rules to at least one of the applications.