Patent ID: 8826419

Claim:
A method of protecting resources in a computer system against tampering by a user process, wherein the computer system includes at least a memory unit and a processor unit, the method comprising: providing a plurality of resources of the computer system using the memory unit and the processor unit; identifying one or more of the plurality of resources of the computer system as being key resources which are associated with a security application in the computer system; controlling access to the one or more key resources of the computer system using an access control list; providing the user process, initially, in an unprivileged user-level security context, the user process having low privileges and including an initial access token that defines the low privileges and access rights for the user process to allow the user process to access the key resources according to the access control list; performing, by a security application, process elevation to selectively grant a privileged user-level security context to the user process thereby dynamically elevating the privilege level of the user process; executing the user process in the user-level security context in accordance with the dynamically elevated privilege level; creating a protection group as a local security group; adding a deny access control entry to the access control list thereby restricting access to the key resources of the security application by members of the protection group; intercepting the user process; creating a revised access token by revising the initial access token of the user process to include the protection group, thereby identifying the user process as a member of the protection group; applying the revised access token to the user process; and in response to the user process requesting access to any of the one or more key resources of the security application, matching the protection group in the revised access token of the user process against the deny access control entry in the access control list of the key resources, thereby restricting access by the user process to the key resources.