Methods and systems for implementing a secure application execution environment using derived user accounts for internet content

1. A method for providing resource content use comprising:

requesting a resource at a computing system, wherein the resource is associated with an application layer abstraction in an application;

intercepting the request for the resource using a mediator at an application layer;

determining, using the mediator, if the resource is trusted or untrusted to enable application layer semantics for the application layer abstraction;

if the resource is determined to be trusted, accessing the resource in a first derived user account (DUA); and

if the resource is determined to be untrusted, create a protected DUA, accessing the resource in the protected DUA, redirect the intercepted request to the protected DUA, wherein the protected DUA provides unrestricted access to the resource, and wherein the protected DUA and the first DUA are both associated with a same user and are dynamically invoked based on the resource within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted resources.

2. The method of claim 1 , wherein the determining further comprises:

receiving content from the resource at the computing system.

3. The method of claim 2 , wherein the determining further comprises:

determining, using the mediator, if the resource is trusted or untrusted based on a partition of the resource.

4. The method of claim 3 , wherein the determining further comprises:

identifying the resource based on a characteristic of the resource; and

partitioning the resource as trusted or untrusted based on the identified characteristic.

5. The method of claim 1 , further comprising:

creating the first DUA when the resource is trusted; and

redirecting the intercepted request to the first DUA when the resource is trusted.

6. The method of claim 1 , wherein the protected DUA is different than an original user account (OUA) or a DUA associated with the application.

7. The method of claim 1 , wherein the application layer abstraction is an email message, instant message, uniform resource locator (URL), cookie, certificate, or template.

8. A computing system for providing secure content comprising:

at least one memory hosting a protected derived user account (DUA) and a first DUA; and

at least one processor configured to:

request a resource at a computing system, wherein the resource is associated with an application layer abstraction in an application;

intercept the request for the resource using a mediator at an application layer;

determine, using the mediator, if the resource is trusted or untrusted to enable application layer semantics for the application layer abstraction;

if the resource is determined to be trusted, access the resource in the first derived user account (DUA); and

if the resource is determined to be untrusted, create a protected DUA, access the resource in the protected DUA, redirect the intercepted request to the protected DUA, wherein the protected DUA provides unrestricted access to the resource, and wherein the protected DUA and the first DUA are both associated with a same user and are dynamically invoked based on the resource within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted resources.

9. The computing system of claim 8 , wherein the processor is further configured to receive content from the resource at the computing system.

10. The computing system of claim 9 , wherein the processor is further configured to:

determine, using the mediator, if the resource is trusted or untrusted based on a partition of the resource.

11. The computing system of claim 10 , wherein the processor is further configured to:

identify the resource based on a characteristic of the resource; and

partition the resource as trusted or untrusted based on the identified characteristic.

12. The computing system of claim 8 , wherein the processor is further configured to:

create the first DUA when the resource is trusted; and

redirect the intercepted request to the first DUA when the resource is trusted.

13. The computing system of claim 8 , wherein the protected DUA is different than an original user account (OUA) or a DUA associated with the application.

14. The computing system of claim 8 , wherein the application layer abstraction is an email message, instant message, uniform resource locator (URL), cookie, certificate, or template.

15. A non-transitory computer-readable medium containing instructions for controlling a computing system having at least one processor, to perform a method comprising:

requesting a resource at the computing system, wherein the resource is associated with an application layer abstraction in an application;

intercepting the request for the resource using a mediator at an application layer;

determining, using the mediator, if the resource is trusted or untrusted to enable application layer semantics for the application layer abstraction;

if the resource is determined to be trusted, accessing the resource in a first derived user account (DUA); and

if the resource is determined to be untrusted, create a protected DUA, accessing the resource in the protected DUA, redirect the intercepted request to the protected DUA wherein the protected DUA provides unrestricted access to the resource, and wherein the protected DUA and the first DUA are both associated with a same user and are dynamically invoked based on the resource within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted resources.

16. The non-transitory computer-readable medium of claim 15 , wherein the instructions further control the computing system to perform a method comprising: receiving content from the resource at the computing system.

17. The non-transitory computer-readable medium of claim 16 , wherein the instructions further control the computing system to perform a method comprising: determining, using the mediator, if the resource is trusted or untrusted based on a partition of the resource.

18. The non-transitory computer-readable medium of claim 17 , wherein the instructions further control the computing system to perform a method comprising: identifying the resource based on a characteristic of the resource; and partitioning the resource as trusted or untrusted based on the identified characteristic.

19. The non-transitory computer-readable medium of claim 15 , wherein the instructions further control the computing system to perform a method comprising: creating the first DUA when the resource is trusted; and redirecting the intercepted request to the first DUA when the resource is trusted.

20. The computer-readable medium of claim 15 , wherein the protected DUA is different than an original user account (OUA) or a DUA associated with the application.

21. The non-transitory computer-readable medium of claim 15 , wherein the application layer abstraction is an email message, instant message, uniform resource locator (URL), cookie, certificate, or template.