A method of controlling access to a plurality of data files stored in a non-volatile storage memory of a computing device, wherein the plurality of data files includes a plurality of protected data files, the method performed using a processor configured to operate a rich operating system in a rich execution environment and a trusted operating system in a trusted execution environment, the method comprising: (a) receiving, by a kernel module operating within a kernel of the rich operating system, a file request for a requested file stored in the non-volatile storage memory, wherein the requested file corresponds to one of the protected data files in the plurality of protected data files, and wherein the file request is received from a requesting process operating within the rich operating system; (b) determining, by the kernel module, an associated application associated with the requesting process, wherein the associated application corresponds to one of the applications installed on the computing device; (c) determining, by the kernel module through communication with a trusted application operating in the trusted operating system, whether a validated application token is present for the associated application; and (d) permitting, by the kernel module, the requesting process to access the requested data file only if the validated application token is present and otherwise prevent the requesting process from accessing the requested data file; wherein the validated application token for the associated application is generated by the processor by: detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment. (a) receiving, by a kernel module operating within a kernel of the rich operating system, a file request for a requested file stored in the non-volatile storage memory, wherein the requested file corresponds to one of the protected data files in the plurality of protected data files, and wherein the file request is received from a requesting process operating within the rich operating system; (b) determining, by the kernel module, an associated application associated with the requesting process, wherein the associated application corresponds to one of the applications installed on the computing device; (c) determining, by the kernel module through communication with a trusted application operating in the trusted operating system, whether a validated application token is present for the associated application; and (d) permitting, by the kernel module, the requesting process to access the requested data file only if the validated application token is present and otherwise prevent the requesting process from accessing the requested data file; wherein the validated application token for the associated application is generated by the processor by: detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment. detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment.