Object Definition Hierarchy for Granular Access Control

The patent segments the monolithic permission management system into a hierarchical structure where permissions are divided and assigned at multiple levels (parent objects and child objects). This allows the system to maintain precise access control by checking permissions at each level of the hierarchy, while reducing overall complexity by avoiding the need to manage every possible user-action-object combination explicitly.

The patent introduces a hierarchical dimension to permission management by organizing objects into parent-child relationships. Instead of managing permissions in a flat, two-dimensional user-action matrix, the system adds a third dimensional layer (object hierarchy levels) where permissions can be inherited and propagated, thereby reducing the complexity of managing permissions across large numbers of users and objects.

The patent applies preliminary action by pre-establishing the hierarchical structure of objects and pre-defining permission rules at parent levels before actual access requests occur. When a user requests access to a child object, the system has already prepared the inheritance relationships and can quickly determine permissions by traversing the pre-built hierarchy, rather than computing permissions from scratch for each access request.

By segmenting the permission checking process into hierarchical levels, the system can stop the checking process early once permission is granted at any level, reducing the average time required compared to checking all possible user-action-object combinations regardless of hierarchy.

The patent makes the permission assignment mechanism universal by allowing a single permission assignment at a parent object level to automatically apply to multiple child objects. This multi-functionality enables administrators to manage permissions more easily by working at higher levels of the hierarchy, while the system maintains secure control by still evaluating permissions against the specific child object being accessed.

The patent merges the permission management of multiple child objects into a single parent object assignment. Instead of requiring separate explicit assignments for each child object, the system combines them through the hierarchical relationship, thereby improving ease of operation while maintaining security through the inheritance mechanism.