Patent ID: 7650604

Claim:
An access management method of causing a computer to permit or prohibit access to each of a plurality of data element objects stored in an internal or an external data storage, wherein the method comprises: organizing within the computer the plurality of data element objects into a hierarchal tree structure wherein the data element objects are represented by a plurality of nodes where a node of an uppermost hierarchy is regarded as a root node; representing a position of each of the nodes in the hierarchal structure by a character string wherein the character string includes a node name on a route from the root node to an object node and wherein the position is further represented by one or more constants; storing one or more rule functions that determine whether access to the object node should be permitted or rejected depending on the position of the object node in the hierarchical structure, in association with each of a plurality of requesters, whose access to the object node is different from each other, the one or more rule functions further including access control effects controlling access to the object node and descendant object nodes associated with the object node; generating one or more classes wherein the one or more rule functions are assembled together; receiving an access request from a requester from the plurality of requesters; selecting a rule function associated with the requester of the access request from the one or more rule functions; executing the selected rule function, which has been selected by a selector, by calling the rule function one of the generated one or more classes using the position of the object node marked by one of the one or more constants by comparing the position of the object node to be accessed with the selected rule function; determining if the requester of the access request is permitted access to the object node to be accessed and descendant object nodes associated with the object node to be accessed based on the access control effects associated with the requester of the access request; and controlling permission or prohibition of the access request in the computer based on the executing of the rule function.