Patent ID: 8161014

Claim:
In a computer system, having resources and an operating system that provides access to the resources, wherein one of the resources is a computer file system, a method for managing access to computer files stored in the computer file system, the steps comprising: creating at least one access rule relationship that comprises a potential user attribute set that applies to all users and contains one or more attributes of a potential user of the computer system, a file access set that applies to all file access operations and contains one or more file access operations, a computer file attribute set that applies to all files and contains one or more attributes of one or more computer files and an action description set that contains an action indication taken from the group of allow access, deny access, allow access and audit, and deny access and audit; storing said access rule relationship separate from said the attributes of said potential user and separate from said attributes of said one or more computer files; receiving from said operating system, a request by a user of said computer system to access a computer file stored in the file system; identifying said user making said request; identifying one or more attributes of said user; identifying an access operation upon which the request is based; identifying one or more attributes of the computer file upon which the request is based; defining a requesting user set which comprises the identified attributes of said user, the identified access operation, and the identified attributes of the computer file; retrieving said access rule relationship; and comparing said access rule relationship and said requesting user set and if said access rule relationship contains an indication of all users or if one or more of the identified attributes of said user is found in the potential user attribute set of said access rule relationship and if said access rule relationship contains an indication of all file access operations or if the identified access operation is found in the file access set of said access rule relationship and if said access rule relationship contains an indication of all files or if one or more of the identified attributes of the computer file is found in the computer file attribute set of said access rule relationship then permitting the access operation according to the action description of said access rule relationship, otherwise denying said request.