Patent ID: 7752439

Claim:
A data processing system for managing access to resources, the data processing system comprising: a bus system; a memory connected to the bus system, wherein the memory includes a set of instructions; and a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to grant a security identifier given by an access control list to a process in response to matching an entry in the access control list of a specific resource with credentials of the process, wherein the security identifier has no meaning outside of being used to make an access decision for the specific resource, and wherein granting the security identifier further comprises: adding the security identifier to the credentials of the process to form an object access identifier, wherein the object access identifier is granted based on a path of execution; limiting a scope of the security identifier to an application space, wherein access rights associated with the security identifier are limited to a specific application, and wherein propagation of access rights is prevented by specifying the access rights are limited to the specific application; and identifying the security identifier as an unavailable security identifier that is no longer available to be granted to other processes in response to granting the security identifier to the process, wherein the security identifier is not reused; and to generate the access decision based on the security identifier in response to the process requesting access to the specific resource.