Patent ID: 7716734

Claim:
A computer system comprising: a processing unit; and system memory which stores an operating system comprising a reference monitor incorporated as part of the operating system to control access by principals to computing resources of the computer system, the reference monitor comprising program instructions that are executable by the processing unit to perform a pattern matching process to determine if a principal identifier, which is associated with a principal requesting access to a computing resource, matches a pattern for acceptable principal identifiers associated with said computing resource, wherein said principal is a process, and wherein said principal identifier is maintained as a tree data structure comprising identifiers for trusted entities in the computer system, said tree data structure comprising at least one of a program identifier, a user identifier, or a role identifier, wherein said principal identifier comprises an expression of an execution history of the principal associated with said principal identifier, wherein said pattern for acceptable principal identifiers includes pattern parameters that specify a required program identifier and a required user identifier, and wherein said principal is granted access to said computing resource if said principal identifier matches pattern parameters specified in said pattern for acceptable principal identifiers.