Patent ID: 7734649

Claim:
A computer implemented method, comprising: initializing data access control information associated with each of a plurality of data elements in a computer readable storage medium, wherein the data access control information associated with each of the data elements includes a user access list indicating authorized users and different access levels for authorized users, and a data access list indicating at least one data element other than the data element associated with the data access control information that may be involved in a derivation with the data element associated with the data access control information including the data access list to form a derived data element; receiving a derivation request from one user to subject a first and second data elements of the data elements to a derivation operation to form the derived data element, wherein the derivation comprises aggregating or combining data elements; processing the data access control information associated with the first and second data elements to determine whether the user access list and the data access list in the processed data access control information permit the user to derive the derived data element from the first and second data elements by performing: determining from the data access control information for one of the first and second data elements whether the user is indicated on the user access list of the data access control information and the access level of the user when indicated in the user access list; and determining whether the access level of the user permits the user to perform the requested derivation on the first and second data elements, wherein different access levels for different users permit different derivations of data elements indicated in the data access list; and processing, by the derivation operation, the first and second data elements to produce the derived data element comprising data based on the processed first and second data elements in response to determining that the user access list and the data access list permit the user to derive the derived data element from the first and second data elements.