Hierarchical password capabilities

We present a paradigm for access control to typed objects logically connected to form a hierarchy, whereby each object has a single parent, and may have children. Protection domains are divided into three classes. A vertical domain includes authorizations for the objects in a subhierarchy. A horizontal domain includes authorizations for the children of a given object. A simple domain includes an authorization for a single object. We introduce the hierarchical capability concept as a generalization of the classical password capability concept. A hierarchical capability references an entire domain instead of a single object.