Patent ID: 7483896

Claim:
A computer-implemented method for controlling user access to data resources, comprising the steps of: inventorying the data resources whose access is to be controlled; generating a requirements data structure that includes a first bit string including a first plurality of elements, each of which being mapped to a separate one of the inventoried data resources and being configured to store a requirement bit value; setting, for each of the first plurality of elements, the requirement bit value according to an authorization level necessary to access the mapped data resource; defining and storing, for each user to have access to any of the inventoried data resources, a grant data structure that includes a second bit string including a second plurality of elements, each of which being mapped to a separate one of the inventoried data resources and being configured to store a grant bit value; setting, for each of the second plurality of elements, the grant bit value according to an authorization granted to the user to access the mapped data resource; receiving a user request including a SQL query for access to at least one of the secured data resources; performing a bit-wise comparison of the grant and requirements data structures and disallowing access by the received user request to any secured data resource that is mapped to any element of the requirement data structure whose requirement bit value is greater than the grant bit value of a corresponding element of the grant data structure.