Patent ID: 8689285

Claim:
A method for rule-based group security data management, the method performed by a data processing system and comprising: receiving, by the data processing system, a complex rule set corresponding to at least one electronic document, the complex rule set including a combination of granting rules, denying rules, and rule precedence; generating derived user groups, by the data processing system, according to the complex rule set; identifying derived grant groups that correspond to members of original user groups that are granted access to the electronic document by a grant rule of the complex rule set, excluding members of the original user groups that were denied access to the electronic document by a higher-precedence deny rule of the complex rule set; deriving grant rules for each electronic document, by the data processing system, according to the complex rule set to produce a derived grant rule set, wherein the derived grant rule set has a derived grant rule for each grant rule in the complex rule set, and does not have derived grant rules for any deny rule in the complex rule set; and storing the derived grant rules, by the data processing system, as associated with the electronic document.