WEB PAGE SECURITY SYSTEM AND METHOD

• US 20060036870A1
• Filed: 08/11/2005
• Published: 02/16/2006
• Est. Priority Date: 08/11/2004
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Marketing & Development Corporation (American Express Company)
• Inventors: Harvey, Kevin, Sockrider, Cathy, Dasari, Srinivas V
• Granted Patent: US 8,307,291 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A security application for granting different access rights to web pages and objects on each web page is disclosed. A data table assigns one or more function identifiers (FIDs) to users. A second data table assigns a different object identifier (OID) to each web page, and to assign a different OID for each object on each web page. A third data table assigns an FID to each OID. When a user attempts to access a web page or an object on the web page, a web server compares each of the user'"'"'s FIDs to the FID assigned to the web page or object. The web server grants access to the web page or object if one of the user'"'"'s FIDs matches the FID assigned to the web page or object, the user is granted access to the web page or object according to the function of the matched FID.

Claims

1. A computer-implemented method to control access to web pages and to control access to objects, wherein one of said objects are included on each of said web pages, said method comprising the steps of:

assigning, in a first data table, a first user function identifier (FID) to a first user;

assigning, in a second data table, a first object identifier (OID) to a first web page;

assigning, in said second data table, a second OID to a first object on said first web page;

assigning a first FID to said first OID;

assigning a second FID to said second OID;

granting access, by a server, to said first web page when said first user FID substantially matches said first FID; and

granting access, by said server, to said first object when said first user FID substantially matches said second FID, wherein said first user FID, said first FID, and said second FID are each part of a plurality of FIDs comprising a display FID and an input FID.

2. The computer-implemented method of claim 1, wherein said step of granting access to said first web page comprises the step of permitting said first user to perform a function on said first web page corresponding to said substantially matched first user FID and said first FID.

3. The computer-implemented method of claim 1, wherein said step of granting access to said first object comprises the step of permitting said first user to perform a function on said first object corresponding to said substantially matched first user FID and second FID.

4. The computer-implemented method of claim 1, further comprising assigning, in said first data table, a second user FID to said user, wherein said first user FID and said second user FID are different FIDs and said second user FID is part of said plurality of FIDs, wherein said first FID and said second FID are different FIDs.

5. The computer-implemented method of claim 4, wherein said first user FID is said display FID and said first FID is said display FID, and wherein said step of granting access to said first web page comprises granting display access to said first web page.

6. The computer-implemented method of claim 5, wherein said second user FID is said input FID and said second FID is said input FID, and wherein said step of granting access to said first object comprises granting input access to said first object.

7. The computer-implemented method of claim 4, further comprising:

assigning, in said second data table, a third OID to a second web page;

assigning a third FID to said third OID; and

granting access, by said server, to said second web page when at least one of said first user FID and said second user FID substantially match said third FID.

8. The computer-implemented method of claim 7, further comprising:

assigning, in said second data table, a fourth OID to a second object on said second web page;

assigning a fourth FID to said fourth OID; and

granting access, by said server, to said second object when at least one of said first user FID and said second user FID substantially match said fourth FID.

9. The computer-implemented method of claim 1, wherein said plurality of FIDs further comprise an edit FID.

10. The computer-implemented method of claim 9, wherein said second user FID is said edit FID and said second FID is said edit FID, and wherein said step of granting access to said first object comprises granting edit access to said first object.

11. The computer-implemented method of claim 1, further comprising assigning, in said first data table, a second user FID to a second user, wherein said second user FID is part of said plurality of FIDs.

12. The computer-implemented method of claim 1, wherein said step of granting access to said first web page comprises the step of granting access to said first web page when said second user FID substantially matches said first FID.

13. The computer-implemented method of claim 1, wherein said step of granting access to said first object comprises the step of granting access to said first object when said second user FID substantially matches said second FID.

14. The computer-implemented method of claim 1, further comprising changing said first FID to a third FID without changing a program operating said first web page, wherein said first FID and said third FID are different FIDs.

15. The computer-implemented method of claim 1, further comprising assigning a third FID to said first OID without changing a program operating said first web page, wherein said first FID and said third FID are different FIDs.

16. The computer-implemented method of claim 14, further comprising subtracting at least one of said first FID and said third FID from being assigned to said first OID without changing a program operating said first web page.

17. The computer-implemented method of claim 1, further comprising changing said second FID to a third FID without changing a program operating said first object, wherein said second FID and said third FID are different FIDs.

18. The computer-implemented method of claim 1, further comprising assigning a third FID to said second OID without changing a program operating said first object, wherein said second FID and said third FID are different FIDs.

19. The computer-implemented method of claim 17, further comprising subtracting at least one of said second FID and said third FID from being assigned to said second OID without changing a program operating said first web page.

20. The computer-implemented method of claim 1, wherein said step of assigning said first FID to said first OID comprises the step of assigning said first FID to said first OID in a third data table;

and said step of assigning said second FID to said second OID comprises the step of assigning said second FID to said second OID in said second data table.

21. A computer including a multi-tiered security application, comprising:

a server configured to operate web pages and a plurality of objects, wherein one of said plurality of objects is on each of said web pages;

a first data table configured to assign a user function identifier (FID) to each of a plurality of users; and

a second data table configured to assign an object identifier (OID) to each of said web pages, assign an OID to each object on each of said web pages, and assign an FID to each OID, wherein said user FIDs and said FIDs assigned to each OID are part of a plurality of FIDs.

22. The computer of claim 21, wherein said server is configured to:

compare said user FID to a first FID when a user attempts to access a web page; and

grant function access to said web page when said user FID substantially matches said first FID, said function access corresponding to a function of said substantially matched user FID and first FID.

23. The computer of claim 22, wherein said server is further configured to:

enable said user to view said web page when said user FID and said first FID are both a display FID.

24. The computer of claim 22, wherein said server is further configured to:

enable said user to input information into said web page when said user FID and said first FID are both an input FID.

25. The computer of claim 22, wherein said server is further configured to:

enable said user to edit said web page when said user FID and said first FID are both an edit FID.

26. The computer of claim 21, wherein said server is configured to:

compare said user FID to a first FID when a user attempts to access a web page;

grant a first function access to said web page when said user FID substantially matches said first FID, said first function access corresponding to a first function of said substantially matched user FID and first FID;

compare said user FID to a second FID when said user attempts to access an object on said web page; and

grant a second function access to said object when said user FID substantially matches said second FID, said second function access corresponding to a second function of said substantially matched user FID and second FID.

27. The computer of claim 26, wherein said server is further configured to:

enable said user to view said object when said user FID is said display FID and said first FID are both a display FID;

enable said user to input information into said object when said user FID and said first FID are both an input FID; and

enable said user to edit said object when said user FID and said first FID are both an edit FID.

28. A machine-readable medium having stored thereon a plurality of instructions, said plurality of instructions when executed by a processor cause said processor to perform a method comprising said steps of:

assigning, in a first data table, a first user function identifier (FID) to a first user;

assigning, in a second data table, a first object identifier (OID) to a first web page;

assigning, in said second data table, a second OID to a first object on said first web page;

assigning, in said second data table, a first FID to said first OID;

assigning, in said second data table, a second FID to said second OID;

granting access, by a server, to said first web page when said first user FID substantially matches said first FID; and

granting access, by said server, to said first object when said first user FID substantially matches said second FID, wherein said first user FID, said first FID, and said second FID are each part of a plurality of FIDs comprising a display FID and an input FID.