Patent ID: 8732847

Claim:
A method, steps of the method comprising: establishing a plurality of security classes for a plurality of applications, each security class of said plurality of security classes defining a plurality of privileges for an application of the plurality of applications, wherein privileges defined in at least one security class in said plurality of security classes include at least one aggregate privilege that is based on at least two constituent privileges; binding each access control list of a plurality of access control lists to a corresponding security class of said plurality of security classes, wherein said each access control list of said plurality of access control lists comprises one or more access control entries that each define whether a subject has any one or more of a plurality of privileges defined in the corresponding security class to which said each access control list is bound; in response to receiving a specific request to check whether a specific subject has been granted an aggregate privilege that is based on two or more constituent privileges, identifying a security class that defines a plurality of privileges that include the aggregate privilege, said security class belonging to said plurality of security classes; in response to identifying the security class, identifying one or more access control lists bound to the security class; determining, based on access control entries in the one or more access control lists bound to the security class, whether the specific subject has been granted the aggregate privilege; wherein said determining, based on access control entries in the one or more access control lists bound to the security class, whether the specific subject has been granted the aggregate privilege includes determining one of either (a) whether the specific subject has been granted all of the two or more constituent privileges individually or (b) whether the specific subject has been granted said aggregate privilege directly; wherein each of the steps of the method is performed by one or more computing devices.