Patent ID: 7313692
Filing Date: 2007-12-25
Classification: G06F,H04L

Abstract:
1. In a computer-implemented authorization management system, a method for controlling a user's access to a computing resource that is managed by said computer-implemented authorization management system, the method including: receiving an electronic request for the computing resource; retrieving a group of computer-readable authorization certificates from at least one computer-readable authorization certificate storage location accessible to said computer-implemented authorization management system, each certificate containing at least one computer-readable authorization by at least one principal; identifying a set of principals associated with the group of computer-readable authorization certificates; creating a lattice of authorization values associated with each principal of said set of principals in a memory device in communication with the computer-implemented authorization system, wherein the lattice of authorization values is a monotone function of one or more authorization values of the set of principals; evaluating a certificate as a monotone function, at least in part, of the one or more authorization values associated with one or more of the principals; updating the one or more authorization values of one or more of the principals if the result of said evaluating step indicates that an authorization value of a principal should be changed, the step of updating the authorization value being a monotone function; and repeating said evaluating and updating steps until a steady state of said lattice of authorizations values is reached.