Patent ID: 7600254

Claim:
A computer processor-based setting apparatus for setting any of authorization for and prohibition of access to data with a hierarchical structure, wherein a plurality of objects comprising the hierarchical structure constitute a tree structure, and a root node of the tree structure represents the object at a highest level in hierarchy, and a leaf node of the tree structure represent the object at a lowest level in hierarchy; the setting apparatus comprises: an abstract structure generation unit recorded on a computer-storage medium for bringing a plurality of objects whose relative position regarding the root node as a starting point is the same, and whose type is the same together, and for generating an abstract hierarchical structure generated as one abstract object, based on an inclusion relation among tags in a structured document; an object selection unit recorded on a computer-storage medium for selecting at least one object from a plurality of objects constituting the hierarchical structure; a pattern selection unit recorded on a computer storage medium for selecting at least one pattern from a plurality of patterns, each of which determines a relative position in the hierarchical structure to the object selected by the object selection unit, and including and selecting a sub-pattern not processed by the setting apparatus in the plurality of patterns; a pattern registration unit for registering patterns with a history of being consecutively selected twice or more in the past; an access control policy setting unit recorded on a computer storage medium for setting an access control condition, which are any of authorization for and prohibition of access to the object selected by the object selection unit, and each of objects at the relative position to the selected object, the relative position being determined by the pattern selected by the pattern selection unit, wherein the access control policy setting unit sets, as the access control condition for each object, a condition to be satisfied by any one of identification information of the user who accesses the relevant object, an attribute of the user, or a type of the accesses among types of accesses including reading and writing from/into the relevant object.