Methods and systems for implementing a secure application execution environment using derived user accounts for internet content

1. A method comprising:

intercepting a request for installing an application;

determining, based upon a network resource providing the application, if the application is trusted or untrusted;

if the application is determined to be trusted, installing and executing the application within a first user account; and

if the application is determined to be untrusted:

creating a second user account;

installing and executing the application within the second user account; and

associating the application with the second user account wherein the second user account and the first user account are both associated with a same user and are dynamically invoked based on the application within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted applications,

wherein the second user account is persistent, and wherein the associated application is configured to launch within the second user account on subsequent executions of the application.

2. The method of claim 1 , wherein the application is an extension of another application.

3. The method of claim 2 , wherein the extension is a plug-in and the other application is a browser.

4. The method of claim 1 , further comprising storing resources associated with the associated application in association with the second user account.

5. The method of claim 4 , wherein the resources are stored in a space partitioned for the application.

6. The method of claim 4 , wherein the resources are tagged and stored in a global repository.

7. The method of claim 4 , further comprising substituting global resources with the resources associated with the application upon execution of the application.

8. The method of claim 1 , further comprising substituting a controlled input/output path for user interface interactions for a global system input/output path,

wherein the controlled input-output path is configured to control user access to data operations.

9. The method of claim 1 , further comprising monitoring system user interface controls, wherein the second user account is configured to control user access to data operations based on the monitored system user interface controls.

10. A system comprising:

a memory; and

a processor configured to execute instructions stored in the memory to:

intercept a request for installing a plug-in in a browser;

determine, based upon a network resource providing the plug-in, if the plug-in is trusted or untrusted;

if the plug-in is determined to be trusted, install and execute the plug-in within a first user account; and

if the plug-in is determined to be untrusted:

create a second user account;

install and execute the plug-in within the second user account; and

associate the plug-in with the second user account, wherein the second user account and the first user account are both associated with a same user and are dynamically invoked based on the plug-in within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted plug-ins, wherein the second user account is persistent, and wherein the associated plug-in is configured to launch within the second user account on subsequent executions of the plug-in.

11. The system of claim 10 , wherein the processor is further configured to store resources associated with the associated plug-in in a space partitioned for the plug-in.

12. The system of claim 10 , wherein the processor is further configured to tag and store resources associated with the associated plug-in in a global repository.

13. The system of claim 12 , wherein the processor is further configured to substitute global resources with the resources associated with the plug-in upon execution of the plug-in.

14. The system of claim 10 , wherein the processor is further configured to substitute a DUA controlled input/output path for user interface interactions for a global system input/output path,

wherein the DUA controlled input-output path is configured to control user access to data operations.

15. The system of claim 10 , wherein the processor is further configured to monitor system user interface controls, wherein the second user account is configured to control user access to data operations based on the monitored system user interface controls.

16. A computer program product comprising instructions stored in a non-transitory computer-readable storage medium, the instructions comprising code to:

intercept a request for installing an application;

determine, based upon a network resource providing the application, if the application is trusted or untrusted;

if the application is determined to be trusted, install and execute the application within a first user account; and

if the application is determined to be untrusted:

create a second user account;

install and execute the application within the second user account; and

associate the application with the second user account, wherein the second user account and the first user account are both associated with a same user and are dynamically invoked based on the application within a same integrated user environment of the same user to enable an integrated execution environment for both trusted and untrusted applications

wherein the second user account is persistent, and wherein the associated application is configured to launch within the second user account on subsequent executions of the application.

17. The computer program product of claim 16 , wherein the instructions further comprise code to:

store resources associated with the associated application is a space partitioned for the application;

substitute global resources with the resources associated with the associated application upon execution of the application.

18. The computer program product of claim 16 , wherein the application is a plug-in of a browser.