A method of controlling access to a plurality of data files stored in a non-volatile storage memory of a computing device, wherein the plurality of data files includes a plurality of protected data files, the method performed using a processor configured to operate a rich operating system in a rich execution environment and a trusted operating system in a trusted execution environment , the method comprising: (a) receiving, by a kernel module operating within a kernel of the rich operating system, a file request for a requested file stored in the non-volatile storage memory , wherein the requested file corresponds to one of the protected data files in the plurality of protected data files, and wherein the file request is received from a requesting process operating within the rich operating system; (b) determining, by the kernel module , an associated application associated with the requesting process, wherein the associated application corresponds to one of the applications installed on the computing device; (c) determining, by the kernel module through communication with a trusted application operating in the trusted operating system, whether a validated application token is present for the associated application; and (d) permitting, by the kernel module , the requesting process to access the requested data file only if the validated application token is present and otherwise prevent the requesting process from accessing the requested data file; wherein the validated application token for the associated application is generated by the processor by: detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment ; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment . (a) receiving, by a kernel module operating within a kernel of the rich operating system, a file request for a requested file stored in the non-volatile storage memory , wherein the requested file corresponds to one of the protected data files in the plurality of protected data files, and wherein the file request is received from a requesting process operating within the rich operating system; (b) determining, by the kernel module , an associated application associated with the requesting process, wherein the associated application corresponds to one of the applications installed on the computing device; (c) determining, by the kernel module through communication with a trusted application operating in the trusted operating system, whether a validated application token is present for the associated application; and (d) permitting, by the kernel module , the requesting process to access the requested data file only if the validated application token is present and otherwise prevent the requesting process from accessing the requested data file; wherein the validated application token for the associated application is generated by the processor by: detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment ; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment . detecting initiation of a first process associated with the associated application; determining, by the kernel module through communication with the trusted application, that a valid user code is available within the trusted execution environment ; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment . <EOS>