Patent ID: 7395550

Claim:
In a computer-implemented authorization management system, a method for controlling a user's access to a computing resource that is managed by said computer-implemented authorization management system, the method including: receiving an electronic request for the computing resource from a first principal; identifying a set of principals associated with a group of computer-readable authorization certificates, each certificate in the group of computer-readable authorization certificates containing at least one computer-readable authorization by at least one principal, at least one certificate having been issued by a second principal; initializing a set of authorization values associated with the principals of said set of principals; evaluating a certificate as a monotone function, at least in part, of one or more authorization values associated with one or more of the principals; updating the one or more authorization values associated with the one or more of the principals if the result of said evaluating step indicates that an authorization value of a principal should be changed; and repeating said evaluating and updating steps until an endpoint is reached.