System and method for controlling access to data entities in a computer network

A system for providing user access to data entities in a computer network, comprising:

• at least one application server that stores a plurality of data entities, said data entities accessible by a plurality of users through a plurality of application programs, different of said users having different levels of access with respect to at least some of said data entities;
• a database which stores access rights values that specify access rights of said users with respect to said data entities;
• and
• an access rights cache on said at least one application server, said access rights cache storing access rights lists, said access rights lists obtained from said database in response to requests from said at least one application server, each of said access rights lists comprising a plurality of said access rights values and specifying access rights for a respective one of said plurality of users.

A relational database for storing access rights data which specifies access rights of users with respect to a plurality of data entities of a computer network, said plurality of data entities subdivided into a plurality of categories, said database comprising:

• a first table that maps users to user groups, at least one of said users being a member of multiple of said user groups;
• a second table which contains, for each of said user groups, a group-based access rights list that specifies group-based access rights of members of a respective user group, said group-based access rights list stored in association with a plurality of category identifiers that identify said categories of data entities;
• and
• a third table which contains, for a least one of said users, a user-specific access rights list that specifies special rights for a respective user, said user-specific access rights list stored in association with said plurality of category identifiers.

In a computer network in which different users have different access rights with respect to different data entities, a method of specifying the access rights of a user with respect to a plurality of data entities, comprising the steps of:

• assigning a category identifier to said plurality of data entities;
• storing said category identifier with or in association with each data entity of said plurality of data entities;
• and
• storing an access rights value in association with said category identifier and in further association with an account number of said user, said access rights value specifying said access rights of said user with respect to said plurality of data entities.