Method and device for controlling the access to knowledge networks

A Method for controlling access rights to information objects in a semantic network stored in a digital storage medium, which comprises nodes and edges, constituting a multidimensional network, whereby the nodes represent information objects and the edges represent semantic relations, wherein the semantic network is traversed along the edges, and wherein each edge is defined by a type to exhibit specific semantics, wherein

• a) users or user groups are stored as nodes in said semantic network, wherein
• b) users or user groups are set in relationship with other information objects in said semantic network,
• c) access rights are defined, configured and stored in the form of freely definable, changeable and a searchable hierarchy of access rules in a separate data structure which relates to the objects and semantic relations in the semantic network, wherein the rules are by an administrator,
• d) requests to the access right system are described by the requesting user (u), the semantic object the user requests to access (t), and the operation (op) the user requests to perform on t, wherein target t of an access can be any element of the knowledge net comprising semantic nodes, attributes of a semantic nodes, and relations between semantic nodes,
• e) access permissions to access a semantic object by a user are computed dynamically on demand by traversal of the hierarchy of rules from the top to the bottom and checking the rules in the order of the hierarchy with the request d) to determine if an access is allowed or denied in the moment of the access to the object when performing an operation on the object by the user, wherein
• each rule comprises inner nodes of the rule hierarchy and the inner nodes are related to one either the requesting user, the target, or the operation of the request d), and
• each inner node act as filter for the applicability of the rule,
• leaves of the hierarchy define if any request that has reached the leaf and therefore was not filtered out by previous inner nodes is granted or denied, and
• the order of the hierarchy defines the first applicable rule even if more than one potentially matching rule is present in the hierarchy.