Patent ID: 7184985

Claim:
system for providing secure access to a digital network, comprising: a provider computer operative to: store one or more logic statements defining a security policy for accessing the digital network, each of the one or more logic statements comprising one of the following: a language construct for defining a fact pertaining to an arbitrary security relationship; and a language construct for defining a rule pertaining to an arbitrary security relationship, receive a request from a requester computer for access to the digital network, store one or more logic statements imported from the requester computer, and evaluate the security policy with the stored logic statements to determine whether to grant access to the digital network in response to the request wherein the provider computer is further operative to generate a proof that the security policy is satisfied by the logic statements stored at the provider computer and to determine whether the proof is correct in order to determine whether to grant access to the digital network in response to the request wherein determining whether the proof is correct comprises determining that an authorization atom is derivable from the logic statements stored at the provider computer; a requester computer operative to: transmit a request to access the digital network to the provider computer, and export one or more logic statements to the provider computer; and one or more exporting computers, and wherein the provider computer and the requester computer are further operative to import and store loqic statements from the one or more exporting computers, and wherein the requester computer is further operative to export logic statements received from the one or more exporting computers to the provider computer wherein the provider computer is further operative to derive additional logic statements from the logic statements received from the requester computer and the one or more exporting computers wherein the requester computer is further operative to derive additional loqic statements from the loqic statements received from the one or more exporting computers wherein the provider computer is further operative to qualify logic statements received from the requester computer to indicate that the statements were received from the requester computer wherein the provider computer is further operative to qualify logic statements received from the one or more exporting computers to indicate that the statements were received from the one or more exporting computers wherein the requester computer is further operative to qualify logic statements received from the one or more exporting computers to indicate that the statements were received from the one or more exporting computers.