DOCUMENT SECURITY WITHIN A BUSINESS ENTERPRISE

• US 20080294478A1
• Filed: 06/17/2008
• Published: 11/27/2008
• Est. Priority Date: 07/19/2004
• Status: Active Grant

• Current Assignee: IRIS Interactive Pty Limited
• Original Assignee: IRIS Interactive Pty Limited
• Inventors: Joshi, Jayant, Joshi, Janaki Jayant
• Granted Patent: US 8,631,504 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A computer-based method for defining an enterprise organisation providing electronic document security. Enterprise elements of management groups are defined to correspond with an area of accountability, each group having one of several types, including “line of business”, “key results area”, and “senior management”. Each group has several subgroups, including “group head”, “administrative assistant” and “direct report”. Employees are assigned to one or more management group and subgroup, and management groups are related to each other to represent the organisation hierarchy. Groups may be related as “reports to”, “services”, or other defined relationships. Documents are defined having document content and properties. The properties include owning and related management groups. Access to the document is declared so that employees have a level of access based on membership of one or more groups.

Claims

1. A method for defining an enterprise organisation and protecting information using an interactive computer system, the method comprising the steps of:

a. defining one or more management group and assigning a group type,

b. assigning employees to one or more management group, the assignment including assigning a subgroup type,

c. linking management groups using a relationship,

d. storing the results of steps a., b., and c. in a computer-controlled database,

e. defining one or more documents with content and document properties,

f. granting access rights including a level of access for each document to two or more management groups in accordance with the relationship between the groups,

g. storing the documents in a computer-controlled repository, and using the document properties and the relationship between management groups to allow or deny access to the document.

2. The method of claim 1, further comprising the step of:

altering the representation of an organisation by adding or removing management groups, changing the employees in a management group;

or

adding, removing, or changing the relationships between management groups.

3. The method of claim 1, further comprising the step of:

altering the access to a document by adding or removing groups having access rights, or changing the level of access granted to a group.

4. The method of claim 1, wherein:

the group type is selected from the set of “

line of business”

, “

senior management”

, “

key results area”

, “

competitor brand”

, and “

related stakeholder”

.

5. The method of claim 1, wherein:

the subgroup type is selected from the set of “

group head”

, “

administrative assistant”

, “

direct report”

, “

project leader”

, “

project sponsor”

, “

project manager”

, and “

project team member”

.

6. The method of claim 1, wherein:

the relationship between a pair of groups is selected from the set of “

reports to”

, “

services”

, and “

other relationship”

.

7. The method of claim 1, wherein:

access level is selected from the set of “

no access”

, “

read access”

, “

read/write access”

, “

read/write with create/destroy access”

, “

distribute”

, and “

print”

.

8. Computer software for the definition of an enterprise organisation for protecting enterprise electronic documents, the software comprising:

an interactive interface for defining management groups and subgroups;

employees; and

relationships between two groups and between a group and a employee,

a database for containing the definitions of groups and employees,

an interactive interface for defining documents having document properties and granting access rights to two or more management groups according to a relationship between them and

a repository for containing documents and document properties.

9. The software of claim 8 wherein:

the management groups are of a type selected from the set “

senior management”

, “

line of business”

, “

key results area”

, “

competitor brand”

, and “

other stakeholder”

;

the subgroups are of a type selected from the set “

group head”

, “

administrative assistant”

, “

direct report”

, “

project leader”

, “

project team member”

, “

project manager”

, and “

project sponsor”

.

10. The software of claim 8 wherein:

the relationship between a first group and a second group is selected from the set “

reports to”

, “

services”

, and “

other relationship” and

the relationship between a employee and a group belongs to the set “

member of”

.

11. The software of claim 8 wherein:

employees are related to a group by assigning a membership attribute to one of the group'"'"'s subgroups.

12. The software of claim 8 wherein:

documents are created defining an owning group and zero or more accessing groups wherein the accessing groups have access rights selected from the set “

read-only”

, “

read-write”

, “

create”

, “

destroy”

, “

print”

, and “

distribute”

, such that the members of the accessing group have the defined access rights.

13. A computer database for protecting documents containing records defining management groups, a relationship between management groups, employees, and documents, comprising:

management group records having a management group type and a subtype, employee records having employee properties,

employee-group records relating a employee to one or more management group where one relationship is primary,

group-group records relating a first management group to a second management group,

document records having document properties, and

document-group records assigning access rights for a document to a management group.

14. The computer database of claim 13 wherein:

the group type is selected from the set “

senior management”

, “

line of business”

, “

key results area”

, and “

other stakeholder”

, and the subgroup is selected from the set “

group head”

, “

administrative assistant”

, “

direct report”

, “

project leader”

, “

project team member”

, “

project sponsor” and

“

project manager”

.

15. The computer database of claim 13 wherein:

the employee-group records identify a employee and a group and a subgroup

16. The computer database of claim 13 wherein:

the group-group records have a type selected from the set “

reports to”

, “

services”

, and “

other”

.

17. The computer database of claim 13 wherein:

the document-group records grant access rights for a group to a document, the rights selected from the set “

read-only”

, “

read-write”

, “

distribute”

, “

print”

, “

create”

, and “

destroy”

.

18. The computer database of claim 13 wherein:

access rights to a document for a group and subgroup are defined such that access to the document by a employee is granted only if the employee is a member of the group and subgroup.

19. The computer database of claim 18 wherein:

access rights to a document are selected from the set “

read-only”

, “

read-write”

, “

distribute”

, “

print”

, “

create” and

“

destroy”

.

20. The computer database of claim 13 wherein:

the management group records are used as a network directory using a protocol selected from the set of LDAP, Active Directory, Domino Directory, and X.500.