Patent ID: 7461158

Claim:
A method of selecting a security set for controlling an access to a network element comprising: discovering a plurality of security sets, each security set including an associated access right relevant to the access to the network element; identifying at least two of the plurality of security sets where the associated access right of each of the at least two security sets are in a conflict; determining whether each of the at least two security sets are associated with two or more groups; and resolving the conflict between the at least two security sets; wherein discovering the plurality of security sets further comprises: traversing a hierarchical data structure; and determining for each security set an association with a node on the hierarchical data structure; wherein resolving the conflict further comprises: determining that the at least two security sets are associated with two or more realms; analyzing each of the security sets associated with the nodes of each of the two or more realms to determine whether the associated access right exists; and rejecting access if none of the security sets associated with at least one of the two or more realms includes the associated access right; wherein resolving the conflict further comprises: selecting a higher-level node from which to propagate the associated access right if all of the two or more realms includes the associated access right.