Patent ID: 7793100

Claim:
A method, in a data processing system, for authorizing information flows between elements of the data processing system, the method comprising: associating, by a reference monitor in the data processing system, the elements of the data processing system with security data structures in the reference monitor; receiving, by the reference monitor, an information flow request from a first element to authorize an information flow from the first element to a second element; retrieving, by the reference monitor, a first security data structure associated with the first element; retrieving, by the reference monitor, a second security data structure associated with the second element, wherein the first security data structure and the second security data structure are labelsets, wherein each labelset comprises a labellist element providing one or more labels of the labelset, wherein the labels in the labellist element are composed of a policy type and a value, and wherein the policy type identifies a security policy to be applied to the labelset and the value identifies a value to be used in evaluating the security policy identified by the policy type; and performing, by the reference monitor, at least one set theory operation on the first security data structure and the second security data structure to determine if the information flow from the first element to the second element is to be authorized.