Software security control system and method

• US 20030061482A1
• Filed: 08/23/2002
• Published: 03/27/2003
• Est. Priority Date: 08/23/2001
• Status: Abandoned Application

• Current Assignee: Efunds Corporation (Fidelity National Information Services Incorporated)
• Original Assignee: Efunds Corporation (Fidelity National Information Services Incorporated)
• Inventors: Emmerichs, John Frederick
• Application Number:
  US10/226,686
• Publication Number:
  US 20030061482A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method and apparatus for implementing a software security system in a customer computer system. The method includes requesting permission to display a security-controlled file or application feature when a user attempts to access the security-controlled file or application feature, determining a type of data in the security-controlled file or associated with the security-controlled application feature from at least two types of data, the at least two types of data changing dynamically, and determining whether the user has access to the type of data and providing access to the security-controlled file or application feature if the user has permission to access the type of data. The apparatus for the software security system includes a security repository module, an access security module, and a dynamic security module.

Claims

1. A method of implementing a software security system, the method comprising the acts of:

requesting permission to display a security-controlled file when a user attempts to access the security-controlled file;

determining a type of data in the security-controlled file from at least two types of data, the at least two types of data changing dynamically;

determining whether the user has access to the type of data; and

providing access to the security-controlled file if the user has permission to access the type of data.

2. The method of claim 1, and further comprising the act of installing the software security system on a customer computer system with default security settings.

3. The method of claim 1, and further comprising the act of allowing a security administrator to define security controls for the security-controlled file.

4. The method of claim 1, and further comprising the act of defining a denied appearance for the security-controlled file.

5. The method of claim 4, and further comprising the act of defining a denied appearance of one of hidden and disabled.

6. The method of claim 4, and further comprising the act of displaying the security-controlled file according to the denied appearance if the user does not have permission to access the type of data.

7. The method of claim 1, and further comprising the act of defining a security permission for the security-controlled file.

8. The method of claim 7, and further comprising the act of assigning the security permission to a security key for the security-controlled file.

9. The method of claim 7, and further comprising the act of identifying the security permission of a plurality of users by defining a user profile.

10. The method of claim 9, and further comprising the act of defining a plurality of relationships between the security-controlled file, the security permission, and the user profile.

11. The method of claim 10, and further comprising the act of generating a security table including the user profile, the plurality of relationships, and the security permission.

12. The method of claim 1, and further comprising the act of storing a security configuration file in a security repository module at a remote server.

13. The method of claim 12, and further comprising the act of generating from the security configuration file a security table.

14. The method of claim 13, and further comprising the act of downloading the security table from the security repository module to an access security module at a client computer when the user logs on to the client computer.

15. The method of claim 14, and further comprising the act of removing the security table from the access security module when the user logs off the client computer.

16. The method of claim 14, and further comprising the act of generating an internal security table at the client computer.

17. The method of claim 12, and further comprising the act of changing the security configuration file in the security repository module in order to change the user'"'"'s access to the security-controlled file.

18. The method of claim 1, wherein the security-controlled file is an electronic-funds-transfer transaction file, and further comprising the act of determining a type of electronic-funds-transfer transaction from at least two types of electronic-funds-transfer transactions and determining whether the user has access to the type of electronic-funds-transfer transaction.

19. The method of claim 1, wherein the security-controlled file is a web page.

20. A software security system at least partially stored on a server and at least partially stored on a client computer, the software security system comprising:

a security repository module stored on the server, the security repository module storing a configuration file;

an access security module stored on the client computer for requesting permission from the security repository module for a user to access on the client computer a security-controlled file; and

a dynamic security module stored on the client computer for determining a type of data in the security-controlled file from at least two types of data, the at least two types of data changing dynamically, and for determining whether the user has access to the type of data based on the configuration file.

21. The software security system of claim 20, wherein the access security module and the dynamic security module are stored on the client computer with default security settings.

22. The software security system of claim 20, wherein the configuration file in the security repository module is created by a security administrator.

23. The software security system of claim 20, wherein the security repository module generates a security table from the configuration file.

24. The software security system of claim 23, wherein the security table includes a denied appearance for the security-controlled file.

25. The software security system of claim 24, wherein the denied appearance is one of hidden and disabled.

26. The software security system of claim 24, wherein the access security module displays the security-controlled file according to the denied appearance if the user does not have permission to access the type of data.

27. The software security system of claim 20, wherein the configuration file includes a security permission assigned by a security administrator to a security key for the security-controlled file.

28. The software security system of claim 27, wherein the configuration file includes a user profile defining the security permission for the security-controlled file for a plurality of users.

29. The software security system of claim 27, wherein the configuration file includes a plurality of relationships between the security-controlled file, the security permission, and the user profile as defined by the security administrator.

30. The software security system of claim 29, wherein the security repository module generates a security table including the user profile, the plurality of relationships, and the security permission.

31. The software security system of claim 29, wherein the access security module downloads the security table from the security repository module when the user logs on to the client computer.

32. The software security system of claim 31, wherein the software security system removes the security table from the access security module when the user logs off the client computer.

33. The software security system of claim 31, wherein the access security module generates an internal security table at the client computer.

34. The software security system of claim 20, wherein the security-controlled file is an electronic-funds-transfer transaction file and the dynamic security module determines a type of electronic-funds-transfer transaction from at least two types of electronic-funds-transfer transactions and determines whether the user has access to the type of electronic-funds-transfer transaction.

35. The software security system of claim 20, wherein the security-controlled file is a web page.

36. A method of implementing a software security system, the method comprising the acts of:

assigning a security permission for a user to a security key;

assigning the security key to a security-controlled application feature;

requesting access to the security-controlled application feature before allowing the user to access the security-controlled application feature;

determining a type of data associated with the security-controlled application feature from at least two types of data, the at least two types of data changing dynamically;

determining whether the user has access to the type of data; and

displaying the security-controlled application feature if the security permission assigned to the security key gives the user access to the type of data.

37. The method of claim 36, and further comprising the act of identifying the security permission of a plurality of users by defining a user profile.

38. The method of claim 37, and further comprising the act of defining a plurality of relationships between the security-controlled application feature, the security permission, and the user profile.

39. The method of claim 38, and further comprising the act of generating a security table including the user profile, the plurality of relationships, and the security permission.

40. The method of claim 36, and further comprising the act of storing a security configuration file in a security repository module at a remote server.

41. The method of claim 40, and further comprising the act of generating from the security configuration file a security table.

42. The method of claim 41, and further comprising the act of downloading the security table from the security repository module to an access security module at a client computer when the user logs on to the client computer.

43. The method of claim 42, and further comprising the act of removing the security table from the access security module when the user logs off the client computer.

44. The method of claim 42, and further comprising the act of generating an internal security table at the client computer.

45. The method of claim 40, and further comprising the act of changing the security configuration file in the security repository module in order to change the user'"'"'s access to the security-controlled application feature.

46. The method of claim 36, wherein the security-controlled application feature is one of a control for a graphical user interface, a processing feature, an abstract process, and a control in a web page.

47. A software security system at least partially stored on a server and at least partially stored on a client computer, the software security system comprising:

a security repository module stored on the server, the security repository module storing a security permission for a user, the security permission being assigned to a security key, and the security key being assigned to a security-controlled application feature;

a security module stored on the client computer for requesting access from the security repository module for the user to access on the client computer the security-controlled application feature; and

a dynamic security module stored on the client computer for determining a type of data associated with the security-controlled application feature from at least two types of data, the at least two types of data changing dynamically, and for determining whether the user has access to the type of data based on the security permission for the user assigned to the security key for the security-controlled application feature.

48. The software security system of claim 47, wherein the access security module and the dynamic security module are stored on the client computer using default security settings.

49. The software security system of claim 47, wherein a configuration file is created by a security administrator and stored in the security repository module.

50. The software security system of claim 49, wherein the security repository module generates a security table from the configuration file.

51. The software security system of claim 50, wherein the security table includes a denied appearance for the security-controlled application feature.

52. The software security system of claim 51, wherein the denied appearance is one of hidden and disabled.

53. The software security system of claim 51, wherein the access security module displays the security-controlled file according to the denied appearance if the user does not have permission to access the type of data.

54. The software security system of claim 47, wherein the security permission is assigned by a security administrator to the security key for the security-controlled application feature.

55. The software security system of claim 49, wherein the configuration file includes a user profile defining the security permission for the security-controlled application feature for a plurality of users.

56. The software security system of claim 55, wherein the configuration file includes a plurality of relationships between the security-controlled application feature, the security permission, and the user profile as defined by the security administrator.

57. The software security system of claim 56, wherein the security repository module generates a security table including the user profile, the plurality of relationships, and the security permission.

58. The software security system of claim 50, wherein the access security module downloads the security table from the security repository module when the user logs on to the client computer.

59. The software security system of claim 58, wherein the software security system removes the security table from the access security module when the user logs off the client computer.

60. The software security system of claim 58, wherein the access security module generates an internal security table at the client computer.

61. The software security system of claim 47, wherein the security-controlled application feature is one of a control for a graphical user interface, a processing feature, an abstract process, and a control in a web page.

62. A computer system comprising:

a network;

a server connected to the network, the server including a security repository module; and

a web server connected to the network, the web server including

an operating system;

a web application running on the operating system; and

a foundation interacting with the web application, the foundation configured to interact with a web-browser-based client computer connected to the web server, the foundation including a security module for controlling a user'"'"'s access to a security-controlled web page.

63. The computer system of claim 62, wherein the foundation is embedded in the web application.

64. The computer system of claim 62, wherein the security module includes an access security module for requesting permission from the security repository module for a user to access on the client computer the security-controlled web page.

65. The computer system of claim 64, wherein the security module includes a dynamic security module for determining a type of data in the security-controlled web page from at least two types of data, the at least two types of data changing dynamically.

66. The software security system of claim 65, wherein the access security module and the dynamic security module are stored on the client computer with default security settings.

67. The software security system of claim 62, wherein a configuration file is created by a security administrator and stored in the security repository module.

68. The software security system of claim 67, wherein the security repository module generates a security table from the configuration file.

69. The software security system of claim 68, wherein the security table includes a denied appearance for the security-controlled web page.

70. The software security system of claim 69, wherein the denied appearance is one of hidden and disabled.

71. The software security system of claim 69, wherein the access security module displays the security-controlled web page according to the denied appearance if the user does not have permission to access the type of data.

72. The software security system of claim 67, wherein the configuration file includes a security permission assigned by a security administrator to the security key for the security-controlled web page.

73. The software security system of claim 72, wherein the configuration file includes a user profile defining the security permission for the security-controlled application feature for a plurality of users.

74. The software security system of claim 73, wherein the configuration file includes a plurality of relationships between the security-controlled web page, the security permission, and the user profile as defined by the security administrator.

75. The software security system of claim 74, wherein the security repository module generates a security table including the user profile, the plurality of relationships, and the security permission.

76. The software security system of claim 75, wherein the access security module downloads the security table from the security repository module when the user logs on to the web-browser-based client computer.

77. The software security system of claim 76, wherein the software security system removes the security table from the access security module when the user logs off the web-browser-based client computer.

78. The software security system of claim 76, wherein the access security module generates an internal security table at the web-browser-based client computer.

79. The software security system of claim 62, wherein the security-controlled web page includes a plurality of electronic-finds-transfer transactions, and the dynamic security module determines a type of electronic-funds-transfer transaction from at least two types of electronic-funds-transfer transactions and determines whether the user has access to the type of electronic-funds-transfer transaction.

80. A software security system stored on a server and a client computer, the software security system comprising:

a security repository module stored on the server, the security repository module storing a configuration file and generating a security table based on the configuration file;

an access security module stored on the client computer for requesting permission from the security repository module for a user to access on the client computer a security-controlled file, the access security module downloading the security table from the security repository module when the user logs on to the client computer and removing the security table from the client computer when the user logs off the client computer; and

a dynamic security module stored on the client computer for determining a type of data in the security-controlled file from at least two types of data and for determining whether the user has access to the type of data based on the security table.