Patent ID: 7716473

Claim:
A computer-implemented method of operating a reference monitor simulator to recreate operations performed by a reference monitor on a computer system, the method comprising: defining at least one security rule specifying whether to allow a request to access at least one resource; supplying at least one request to access a resource; applying the at least one security rule in response to the at least one request to access the resource to determine whether to allow the at least one request and to control whether access is granted to the resource; and controlling the reference monitor simulator to operate at an accelerated rate as compared to an actual reference monitor by providing at least one parameter that defines a system environment in which the reference monitor simulator executes, where the at least one parameter includes a time parameter that controls one or more of, eliminating a time gap between trace requests, indicating that a time period between portions of a trace request has elapsed, and running a system clock faster than real-time, where the method being run, at least in part, as an event-driven kernel process.