Computer-implemented data access security system and method

A computer-implemented apparatus for accessing resource objects, wherein the resource objects have multiple associations with other objects, comprising:

• a storage mechanism to store rules which are used in determining whether access is to be granted to resource objects;
• wherein the security rules indicate which associations of a requested resource object are to be used in determining whether access is to be granted to the requested resource object;
• a security request handler with a data access pathway to the security rules;
• wherein the security request handler evaluates at least one security rule to determine whether to grant access to the requested resource object;
• wherein the request to the resource object is processed based upon the evaluated security rule.

A computer-implemented method for accessing resource objects, comprising the steps of:

• receiving a request which involves accessing a resource object;
• evaluating security rules to determine whether to grant access to the requested resource object;
• wherein the security rules establish associations between the resource object and other objects such that the resource object has multiple parent objects;
• determining a security containment boundary with respect to the requested resource object based upon associations which the requested resource object has with other objects;
• wherein the request to the resource object is processed based upon the determined security containment boundary.

A computer-implemented apparatus for accessing resource objects, comprising:

• means for receiving a request which involves accessing a resource object;
• wherein the requested resource object has multiple associations with other objects;
• means for evaluating at least one security rule to determine whether to grant access to the requested resource object;
• wherein the security rule is used to determine a security containment boundary for the requested resource object based upon an association which the requested resource object has with another object;
• wherein the request to the resource object is processed based upon the determined security containment boundary.

A computer-implemented method for accessing resource objects, comprising the steps of:

• receiving a request which involves accessing a resource object;
• wherein the requested resource object has multiple associations with other objects;
• evaluating security rules to determine whether to grant access to the requested resource object;
• wherein the security rules include security containment rules and security authorization rules;
• wherein the security containment rules are used to determine a security containment boundary with respect to the requested resource object based upon associations which the requested resource object has with other objects;
• wherein the request to the resource object is processed based upon the security authorization rules associated with the objects contained within the determined security containment boundary.