Patent ID: 7802294

Claim:
One or more computer-readable memory storage devices comprising computer-executable instructions for controlling an application attempting to access data, the computer-executable instructions comprising: creating a new security token using input from a first security token, the creating comprising: running a first process on an interactive desktop; generating the first security token as part of a process of logging a user on; responding to an attempt by the first process to create the application by accessing, by operation of an application programming interface (API), the first security token, together with information from an application info store; and creating, by operation of the API, the new security token for the application, the new security token comprising all information from the first security token augmented with an application ID of the application, the application ID being provided by the application info store from data obtained from an application manifest; associating the application with the new security token, the new security token additionally comprising a user ID, the application ID being either a strong application ID or a weak application ID, the associating comprising verifying a signature of the application ID to confirm that the application ID is a strong application ID and the application ID being established by: querying a database containing both weak and strong application IDs associated with processes having permission to operate on a computer on which the computer-executable instructions are executing, the query establishing the application ID if the application ID is contained within the database; and establishing, upon failure of the database to contain the application ID, a weak application ID by querying a user of the computer for permission to execute the application; receiving a request from the application for access to the data; and evaluating the request based in part on comparison of the user ID and the application ID of the new security token to an access control list comprising approved user IDs and approved applications IDs, the evaluating allowing access to the data when both the user ID is included within the approved user IDs and also the application ID is included within the approved application IDs, the evaluating allocating more resources to applications with strong IDs than to applications with weak IDs.