Enterprise security management system using hierarchical organization and multiple ownership structure

• US 20060005036A1
• Filed: 11/18/2004
• Published: 01/05/2006
• Est. Priority Date: 07/02/2004
• Status: Active Grant

• Current Assignee: ICE Mortgage Technology, Inc. (Intercontinental Exchange, Inc.)
• Original Assignee: Ellie Mae Incorporated (Intercontinental Exchange, Inc.)
• Inventors: Wu, Ting-Hu, Hu, Limin, Han, Ching-Chih Jason
• Granted Patent: US 8,126,920 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A hierarchical security model for networked computer users is described. Files and resources are controlled or created by users within the network. Each user within the network has an account that is managed by a network administrator. The account specifies the user identifier and password. Users are grouped into organizations depending upon function or other organizational parameter. The groups within the network are organized hierarchically in terms of access and control privileges. Users within a higher level group may exercise access and control privileges over files or resources owned by users in a lower level group. The account for each user further specifies the group that the owner belongs to and an identifier for any higher level groups that have access privileges over the user'"'"'s group. All users within a group inherit the rights and restrictions of the group.

Claims

1. A method of organizing users in an enterprise consisting of a plurality of users each operating a networked computer, the method comprising the steps of:

assigning a user identifier and password to the user;

assigning a group identifier to the user;

specifying a parent group identifier for the group assigned to the user, the parent group identifier identifying a parent group containing one or more superior users that have access to resources owned by the user;

2. The method of claim 1 further comprising the steps of:

storing the user identifier, password, and group identifier information for each user of the plurality of users in a user descriptor table;

storing the group identifier and parent group identifier information in a group descriptor table for each group in the enterprise; and

establishing a hierarchical relationship among the groups based on the group and parent group identifier information.

3. The method of claim 1 wherein the resources owned by the user comprise one or more data files.

4. The method of claim 1 wherein the resources owned by the user comprise one or more devices coupled to the networked computer operated by the user.

5. The method of claim 1 further comprising the step of defining access privileges for the one or more superior users over the resources owned by the user.

6. The method of claim 5 wherein the access privileges include read/write privileges.

7. The method of claim 6 further comprising the step of assigning a persona to the user, the persona indicating a functional role performed by the user in the enterprise.

8. The method of claim 7 wherein the networked computers operated by the users are coupled to a loan broker computer network coupling a server computer to a loan officer client computer a loan processor client computer and a manager client computer.

9. The method of claim 8 wherein the persona comprises one of a manager, a loan broker, a loan officer, and a loan processor.

10. The method of claim 9 wherein the loan broker computer network includes an officer client computer, a processor client computer, and a manager client computer, wherein each computer of the loan broker computer network executing one or more modules of a loan origination program, and wherein the server computer stores user descriptor information for each user in the network, the user descriptor information including user identification and password information, and a reference to the group to which the user belongs.