Abstract: A method, and an operating system utilizing this method, for controlling access rights among a plurality of users to a plurality of secure objects. Each user is provided a user identification number which is prime and each secure object is provided an access code which comprises a value that is a product of the user identification numbers of all users having the same access rights to that secure object. In response to a request by a user for access to a secure object, the access code for that secure object is divided by the user identification number of the requesting user. Access rights of the user to the requested secure object are determined based on whether the result of the division yields a zero remainder.