Patent ID: 8656465

Claim:
A method performed by a computing device having at least one processor, the method comprising: sending, by a first security module executing on the computing device, a request for a first group of permissions to a second security module that is included in an operating system executing on the computing device, wherein: the first security module is not included in the operating system; and the second security module controls access by software applications executing on the computing devices to resources of the computing device based upon permissions granted to the software applications; receiving, from the second security module and by the first security module, the first group of permissions; intercepting, by the first security module that received the first group of permissions from the second security module included in the operating system, a second request from a software application executing on the computing device to access a resource of the computing device; identifying, by the first security module that received the first group of permissions from the second security module included in the operating system, and based at least in part on the second request, a second group of permissions granted to the software application, wherein the second group of permissions is a subset of the first group of permissions; determining, by the first security module that received the first group of permissions from the second security module included in the operating system, and based upon the second group of permissions, a previous authorization based on user input indicating that the software application is allowed to access the resource, the user input being received by the computing device prior to the first security module sending the request for the first group of permissions to the second security module, and the user input being responsive to a previous request from the software application to access the resource; providing to the software application, by the first security module that received the first group of permissions from the second security module included in the operating system and based on the previous authorization, access to the resource.