Patent ID: 7924810

Claim:
A method of controlling access by a user to a computing resource located in a destination domain in a hierarchy of domains, comprising: storing, in a memory, said hierarchy of domains; determining, by a processor, a path from a source domain to said destination domain, based on said hierarchy, wherein said source domain precedes said destination domain in said path; identifying, by said processor, one or more intermediate domains between said source domain and said destination domain in said path; determining, by said processor, for at least one domain preceding said destination domain in said path whether traversal to a successive domain in said path is permitted based on said at least one domain in said path, said successive domain, and a role of said user; and providing to said user access to said computing resource if traversal from said source domain to said destination domain along said path is permitted wherein said processor is configured to selectively deny access by said user to a computer resource located in one or more of said intermediate domains while permitting traversal to said intermediate domains where access has been denied.