Rule-based derived-group security data management

1. A method for rule-based group security data management, the method performed by a data processing system and comprising:

receiving, by the data processing system, a complex rule set corresponding to at least one electronic document, the complex rule set including a combination of granting rules, denying rules, and rule precedence;

generating derived user groups, by the data processing system, according to the complex rule set;

identifying derived grant groups that correspond to members of original user groups that are granted access to the electronic document by a grant rule of the complex rule set, excluding members of the original user groups that were denied access to the electronic document by a higher-precedence deny rule of the complex rule set;

deriving grant rules for each electronic document, by the data processing system, according to the complex rule set to produce a derived grant rule set, wherein the derived grant rule set has a derived grant rule for each grant rule in the complex rule set, and does not have derived grant rules for any deny rule in the complex rule set; and

storing the derived grant rules, by the data processing system, as associated with the electronic document.

2. The method of claim 1 , wherein the data processing system also converts the complex rule set to a negative-bias equivalent if the complex rule set is for a positive-bias system.

3. The method of claim 1 , wherein the data processing system also responds to access requests for the electronic document from users based on the user, the user's membership in a derived grant group, and the grant rule.

4. The method of claim 1 , wherein generating derived user groups includes analyzing each rule in the complex rule set, and a relative precedence of each rule, to identify original user groups that have the same grant or denial to each electronic document.

5. The method of claim 1 , wherein each original user group has a plurality of users.

6. A data processing system comprising:

a hardware processor; and

an accessible hardware memory, the data processing system particularly configured to

receive a complex rule set corresponding to at least one electronic document, the complex rule set including a combination of granting rules, denying rules, and rule precedence;

generate derived user groups according to the complex rule set;

identify derived grant groups that correspond to members of original user groups that are granted access to the electronic document by a grant rule of the complex rule set, excluding members of the original user groups that were denied access to the electronic document by a higher-precedence deny rule of the complex rule set;

derive grant rules for each electronic document according to the complex rule set to produce a derived grant rule set, wherein the derived grant rule set has a derived grant rule for each grant rule in the complex rule set, and does not have derived grant rules for any deny rule in the complex rule set; and

store the derived grant rules as associated with the electronic document.

7. The data processing system of claim 6 , wherein the data processing system also converts the complex rule set to a negative-bias equivalent if the complex rule set is for a positive-bias system.

8. The data processing system of claim 6 , wherein the data processing system also responds to access requests for the electronic document from users based on the user, the user's membership in a derived grant group, and the grant rule.

9. The data processing system of claim 6 , wherein generating derived user groups includes analyzing each rule in the complex rule set, and a relative precedence of each rule, to identify original user groups that have the same grant or denial to each electronic document.

10. The data processing system of claim 6 , wherein each original user group has a plurality of users.

11. A non-transitory computer-readable medium encoded with executable instructions that, when executed, cause one or more data processing systems to:

receive a complex rule set corresponding to at least one electronic document, the complex rule set including a combination of granting rules, denying rules, and rule precedence;

generate derived user groups according to the complex rule set;

identify derived grant groups that correspond to members of original user groups that are granted access to the electronic document by a grant rule of the complex rule set, excluding members of the original user groups that were denied access to the electronic document by a higher-precedence deny rule of the complex rule set;

derive grant rules for each electronic document according to the complex rule set to produce a derived grant rule set, wherein the derived grant rule set has a derived grant rule for each grant rule in the complex rule set, and does not have derived grant rules for any deny rule in the complex rule set; and

store the derived grant rules as associated with the electronic document.

12. The computer-readable medium of claim 11 , wherein the data processing system also converts the complex rule set to a negative-bias equivalent if the complex rule set is for a positive-bias system.

13. The computer-readable medium of claim 11 , wherein the data processing system also responds to access requests for the electronic document from users based on the user, the user's membership in a derived grant group, and the grant rule.

14. The computer-readable medium of claim 11 , wherein generating derived user groups includes analyzing each rule in the complex rule set, and a relative precedence of each rule, to identify original user groups that have the same grant or denial to each electronic document.