# US 5,349,663 A · System for representing hierarchical structures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 5,349,663 A - Document ID: US5349663A - Status: Granted - Kind: A - Application number: 07/907,515 - Filed: 1992-07-01 - Granted: 1994-09-20 - Earliest claimed: 1992-07-01 - Inventors: Ronn H. Bailey - Web page: https://patentgrep.com/patent/US5349663A ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method is provided which represents hierarchical relationships. These relationships are statically stored in a compact manner that allows for easy determination of relations (such as dominance) between any two entities defined to the hierarchy. This stored information is referred to a dominance key or a DOMKEY. DOMKEYs, rather than storing the actual relationship between entities defined to the hierarchical structure, store a representation of the structure itself. In a preferred embodiment, the present invention is applied to computer security systems such as the RACF system and is embedded in a RACF administrator such as Vanguard Integrity Professionals VRA RACF Administrator. ## Claims ### Claim 1 A method for defining hierarchical relationships between functional entities in a hierarchy within a computer system, said hierarchy having a plurality of levels, each level having one or more positions, said method comprising the steps of: providing a computer system including functional entities having hierarchical relationships each of said functional entities corresponding to a position in said hierarchy; defining a DOMKEY for each position in said hierarchy, wherein each DOMKEY is a unique string of information, said step of defining further comprising the steps of: defining one or more logical positions within said DOMKEY; assigning data to each said logical position, said data being capable of representing the maximum number of entities which can be defined to a given level in said hierarchical structure; incorporating the DOMKEYs of higher positions in the hierarchy in their entirety into the DOMKEYs of positions below them in the hierarchy; and assigning a unique DOMKEY to each of the positions which are at the same level in the hierarchy; assigning each functional entity to said position in said hierarchy to which it corresponds; assigning to each functional entity in said hierarchy said defined DOMKEY which has been assigned to said position corresponding to said functional entity in said computer system's hierarchy; and for any selected first and second functional entities in said hierarchy where the second functional entity has a DOMKEY that is longer than that of the first entity, using said DOMKEYs to verify that the second functional entity is at a position below said first functional entity in said hierarchy by determining if the DOMKEY for the first functional entity is contained for its full length in the DOMKEY for the second functional entity. ### Claim 2 (depends on 1) The method of claim 1 wherein successive entities at the same level of the hierarchy are assigned incremental DOMKEYs. ### Claim 3 (depends on 2) The method of claim 2 wherein during the step of defining a DOMKEY DOMKEYs of the entities having dominance over other entities are incorporated by prefixing the DOMKEY of each said other entity with the entire DOMKEY of the entity having dominance over it. ### Claim 4 (depends on 1) The method of claim 1 wherein said step of defining a DOMKEY further comprises the steps of: defining one or more logical positions within said DOMKEY; and assigning data to each said logical position, said data being capable of representing the maximum number of entities which can be defined to a given level in said hierarchical structure. ### Claim 5 (depends on 1) The method of claim 1 wherein said relationships between entities in said hierarchy are such that entities at higher positions in said hierarchy have access to entities in positions below them in the hierarchy. ### Claim 6 (depends on 1) The method of claim 1 wherein said relationships between entities in said hierarchy are such that entities at higher position in said hierarchy have dominance over entities at positions below them in the hierarchy. ### Claim 7 (depends on 1) The method of claim 1 further comprising the steps of defining one of said DOMKEYs as a system DOMKEY, prefixing each DOMKEY with said system DOMKEY, and assigning the system DOMKEY to the highest position in said hierarchy. ### Claim 8 (depends on 1) The method of claim 1 wherein said hierarchy is a security system for said computer system, said entities represent user terminals for said computer system and said step of using said DOMKEYs to verify confirms that said second entity dominates said first entity. ### Claim 9 (depends on 1) The method of claim 1 further comprising the step of generating a report based on said determination which defines the position of each entity in said hierarchy. ### Claim 10 A method for identifying the location of a functional entity in a hierarchy within a computer system said hierarchy having a plurality of levels, each level having one or more positions, said method comprising: providing a computer system including functional entities having hierarchical relationships, each of said functional entities corresponding to a position in said hierarchy; defining a DOMKEY for each position in said hierarchy wherein each DOMKEY is unique string of information said Step of defining further comprising the steps of: defining one or more logical positions within said DOMKEY: assigning data to each said logical position, said data being capable of representing the maximum number of functional entities which can be defined to a given level in said. hierarchical structure: incorporating the DOMKEYs of higher positions in the hierarchy in their entirety into the DOMKEYs of positions below them in the hierarchy; and assigning a unique DOMKEY to each of the positions which are at the same level in the hierarchy: assigning each functional entity to said position in said hierarchy to which it corresponds; assigning to each functional entity in said hierarchy one of said DOMKEYs which has been assigned to said position corresponding to said functional entity in said computer system's hierarchy; and for any selected first and second functional entities in said hierarchy where the second functional entity has a DOMKEY that is longer than that of the first functional entity using said DOMKEYs to verify that the second functional entity is at a position below said first functional entity in said hierarchy by determining if the DOMKEY for the first functional entity is contained for its full length in the DOMKEY for the second functional entity. ### Claim 11 A method for identifying if one functional entity in a hierarchy within a computer system has domination over a second functional entity in said hierarchy, said hierarchy having a plurality of levels, each level having one or more positions, said method comprising: providing a computer system including functional entities having hierarchical relationships, each of said functional entities corresponding to a position in said hierarchy; defining a DOMKEY for each position in said hierarchy wherein each DOMKEY is a unique string of information said step of defining further comprising the steps of: defining one or more logical positions within said DOMKEY: assigning data to each said logical position, said data being capable of representing the maximum number of functional entities which can be defined to a given level in said hierarchical structure; incorporating the DOMKEYs of higher positions in the hierarchy in their entirety into the DOMKEYs of positions below them in the hierarchy; and assigning a unique DOMKEY to each of the positions which are at the same level in the hierarchy; assigning each functional entity to said position in said hierarchy to which it correspond; assigning to each functional entity in said hierarchy one of said DOMKEYs which has been assigned to said position corresponding to said functional entity in said computer system's hierarchy; and for any selected first and second functional entities in said hierarchy where the second functional entity has a DOMKEY that is longer than that of the first functional entity using said DOMKEYs to verify that the second functional entity is at a position below said first functional entity in said hierarchy by determining if the DOMKEY for the first functional entity is contained for its full length in the DOMKEY for the second functional entity, ### Claim 12 A method for determining hierarchical relationships between functional entities in a hierarchy within a computer system, said hierarchy having a plurality of levels, each level having one or more positions, said method comprising: providing a computer system including functional entities having hierarchical relationships, each of said functional entities corresponding to a position in said hierarchy; defining a DOMKEY for each position in said hierarchy whereto each DOMKEY is a unique string of information said step of defining further comprising the steps of: defining one or more logical positions within said DOMKEY: assigning data to each said logical position, said data being capable of representing the maximum number of functional entities which can be defined to a given level in said hierarchical structure: incorporating the DOMKEYs of higher positions in the hierarchy in their entirety into the DOMKEYs of positions below them in the hierarchy; and assigning a unique DOMKEY to each of the positions which are at the same level in the hierarchy; assigning each functional entity to a position in said hierarchy to which it corresponds; assigning to each functional entity in said hierarchy one of said DOMKEYs which has been assigned to said position corresponding to said functional entity in said computer system's hierarchy; and for any selected first and second functional entities in said hierarchy where the second functional entity has a DOMKEY that is longer than that of the first functional entity using said DOMKEYs to verify that the second functional entity is at a position below said said functional entity in said hierarchy by determining if the DOMKEY for the first functional entity is contained for its full length in the DOMKEY for the second functional entity. ### Claim 13 A system for defining relationships between entities in a hierarchy, said hierarchy having a plurality of levels, each level having one or more positions, said system comprising: means for defining a DOMKEY for each position in said hierarchy, wherein each DOMKEY is a unique suing of information, and wherein the DOMKEYs of higher positions in the hierarchy are incorporated in their entirety into the DOMKEYs of positions below them in the hierarchy said means for defining further comprising; means for defining one more logical positions within said DOMKEY; means for assigning data to each said logical position, said data being capable of representing the maximum number of entities which can be defined to a given level in said hierarchical structure: and means for assigning a unique DOMKEY to each position which is at the same level in the hierarchy; means for assigning each entity to one of said positions in said hierarchy; means for assigning to each entity in said hierarchy one of said DOMKEYs which corresponds to the position of said entity in said hierarchy; and means for comparing the DOMKEY for a first entity to determine if it matches for its full length with that of the DOMKEY for a second entity, whereby if said determination results in a match, it is confirmed that the second entity is at a position below said first entity in said hierarchy when said second entity has a DOMKEY that is longer than that of first entity. ### Claim 14 (depends on 13) The system of claim 13 wherein said means for defining a DOMKEY prefixes the DOMKEY of each entity with the entire DOMKEY of any entity having dominance over it. ### Claim 15 (depends on 13) The system of claim 13 wherein said means for defining a DOMKEY further comprises: means for defining one or more logical positions within said DOMKEY; and means for assigning data to each said logical position, said data being capable of representing the maximum number of entities which can be defined to a given level in said hierarchical structure. ### Claim 16 (depends on 13) The system of claim 13 wherein said hierarchy is a security system for a computer. ### Claim 17 (depends on 13) The system of claim 13 further comprising means for generating a report based on said matches which defines the position of each entity in said hierarchy. ### Claim 18 (depends on 17) The system of claim 17 wherein said means for generating a report further comprises means for limiting the report to subjects and objects that are within a report requestor's scope of control. ### Claim 19 (depends on 13) The system of claim 13 further comprising means for command generation; and means for limiting the scope of control of a subject issuing commands by means of said means for command generation, to only those subjects and objects dominated by said subject.