Enterprise security management system using hierarchical organization and multiple ownership structure

• US 8,762,357 B2
• Filed: 02/27/2012
• Issued: 06/24/2014
• Est. Priority Date: 07/02/2004
• Status: Active Grant

• Current Assignee: ICE Mortgage Technology, Inc. (Intercontinental Exchange, Inc.)
• Original Assignee: Ellie Mae Incorporated (Intercontinental Exchange, Inc.)
• Inventors: Hu, Limin, Wu, Ting-Hu, Han, Ching-Chih Jason
• Primary Examiner(s): NGUYEN, KIM T
• Application Number:
  US13/406,472
• Publication Number:
  US 20120158787A1
• Time in Patent Office: 848 Days
• Field of Search: 707/705, 707/778
• US Class Current: 707/705
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A hierarchical security model for networked computer users is described. Files and resources are controlled or created by users within the network. Each user within the network has an account that is managed by a network administrator. The account specifies the user identifier and password. Users are grouped into organizations depending upon function or other organizational parameter. The groups within the network are organized hierarchically in terms of access and control privileges. Users within a higher level group may exercise access and control privileges over files or resources owned by users in a lower level group. The account for each user further specifies the group that the owner belongs to and an identifier for any higher level groups that have access privileges over the user'"'"'s group. All users within a group inherit the rights and restrictions of the group.

Claims

1. A method comprising:

identifying an administrator that has access rights and permissions to all network resources in a set of network resources;

assigning a first set of identifiers to a first set of users;

grouping the first set of users into a plurality of groups;

creating a hierarchical structure for the groups including determining a hierarchical relationship among the groups and the administrator wherein access rights and permissions are established for each group and wherein parent groups inherit access rights and permissions for their respective child groups and wherein the hierarchical structure includes one or more lines that each represent a direct path of related groups to the administrator;

for each user in the first set, associating one or more network resources in the set of network resources with a respective user wherein the one or more network resources are not the same for any user in the first set of users;

assigning a second set of identifiers to one or more of the first set of users, the second set of identifiers associating a respective one of the first set of users with at least one of a second set of users wherein the at least one of the second set of users is granted permission to access the one or more network resources associated with the respective one of the first set of users, wherein the at least one of the second set of users is not the administrator and not a group associated with the respective one of the first set of users or a parent or child group associated with the respective one of the first set of users and wherein the assigning of the second set of identifiers enables sharing of ownership over a respective network resource with a user that is outside of a line in the hierarchy associated with the respective one of the first set of users;

receiving a request from a requestor among the second set of users to access a network resource associated with one of the first set of users;

determining whether the requestor has permission to access the network resource;

determining which privileges the requestor is given relative to the network resource including when or if the requestor has permission to access the network resource; and

providing the requestor with the network resource based on the determined privilege.

2. The method of claim 1, wherein assigning the first identifier includes associating the first set of users with a plurality of child groups, with at least two users in the first set of users being associated with a different child group.

3. The method of claim 2, wherein assigning the second identifier includes:

associating the second set of users with a plurality of parent groups; and

associating at least one of the first set of users in the plurality of child groups with at least one of the second set of users in the plurality of parent groups.

4. The method of claim 3, further comprising:

generating, based on the first identifier, a user descriptor table that specifies the association between each of the first set of users and a respective child group.

5. The method of claim 3, further comprising:

generating, based on the second identifier, a group descriptor table that specifies an association between the plurality of child groups and the plurality of parent groups.

6. The method of claim 5, further comprising:

determining access privilege of at least one of the second set of users with respect to one or more files based on the association specified on the group descriptor table.

7. The method of claim 1, wherein receiving the request includes receiving a request to access one or more data files.

8. The method of claim 1, wherein determining which privileges includes determining whether the requestor has read or write privilege.

9. The method of claim 1 wherein the network resources are associated with a loan origination software system and the shared network resources includes loan data for an individual, wherein the hierarchal structure is an organizational structure based on roles, departments, offices or other divisions and the second set of users are in a different role, department, office or other division in the hierarchical structure.

10. A method of organizing users in an enterprise, the method comprising:

assigning a user identifier and a password to an administrator for the enterprise;

assigning a user identifier and password to at least one user of a plurality of users;

assigning a group identifier to the at least one user for associating with a group;

specifying a parent group identifier for the group assigned to the at least one user, the parent group identifier identifying a parent group containing one or more superior users who have access to resources owned by the at least one user, wherein the one or more superior users are not the administrator and wherein the specifying the parent group identifier enables sharing of ownership over a respective network resource between users in a respective parent group and the at least one user;

assigning, by one or more processors, co-ownership to a resource to the at least one user with a second different user in the plurality of users, wherein the second different user is not the administrator or a user in the group or the parent group associated with the at least one user;

storing the user identifier, password, and group identifier for the plurality of users in a user descriptor table;

storing the group identifier and parent group identifier in a group descriptor table for associating a respective group with a respective parent group; and

establishing a hierarchical relationship among the respective group and respective parent group based on the group and parent group identifier.

11. The method of claim 10, further comprising defining access privileges for the one or more superior users over the resources owned by the user.

12. A system comprising:

a plurality of first devices; and

a server coupled with the plurality of first devices through a network, wherein the server includes one or more processors that are configured to;

identify an administrator that has access rights and permissions to all network resources in a set of network resources;

assign a first set of identifiers to the plurality of first devices;

grouping the first set of devices into a plurality of groups;

creating a hierarchical structure for the groups including determining a hierarchical relationship among the groups and the administrator wherein access rights and permissions are established for each group and wherein parent groups inherit access rights and permissions for their respective child groups and wherein the hierarchical structure includes one or more lines that each represent a direct path of related groups to the administrator;

for each of the first devices, associating one or more network resources in the set of network resources with a respective device wherein the one or more network resources are not the same for any device in the first plurality of devices;

assign, by the one or more processors, a second set of identifiers to one or more of the plurality of first devices, the second set of identifiers associating a respective one of the plurality of first devices with at least one of a plurality of second devices, wherein the at least one of the plurality of second devices is granted permission to access one or more network resources associated with the respective one of the plurality of first devices wherein the at least one of the second devices is not associated with the administrator and not in a group associated with the respective one of the first set of devices or a parent or child group associated with the respective one of the first set of devices and wherein the assigning of the second set of identifiers enables sharing of ownership over a respective network resource with a device that is outside of a line in the hierarchy associated with the respective one of the first set of devices;

receive a request from a requestor to access a network resource;

determine whether the requestor has permission to access the network resource;

determine which privileges the requestor is given relative to the network resource if the requestor has permission to access the network resource; and

provide the requestor with the network resource based on the determined privilege.

13. The system of claim 12, wherein the server is configured to associate the plurality of first devices with a plurality of child groups, with at least two of the plurality of first devices being associated with a different child group.

14. The system of claim 13, wherein the server is configured to:

associate the plurality of second devices with a plurality of parent groups; and

associate at least one of the plurality of first devices in the plurality of child groups with at least one of the plurality of second devices in the plurality of parent groups.

15. The system of claim 14, wherein the server is configured to:

generate, based on the first identifier, a user descriptor table that specifies the association between each of the plurality of first devices and a respective child group.

16. The system of claim 14, wherein the server is configured to:

generate, based on the second identifier, a group descriptor table that specifies an association between the plurality of child groups and the plurality of parent groups.

17. The system of claim 16, wherein the server is configured to:

determine access privilege of at least one of the plurality of second devices with respect to one or more files based on the association specified on the group descriptor table.

18. The system of claim 12, wherein the server is configured to receive a request to access one or more data files.

19. The system of claim 12, wherein the server is configured to determine whether the requestor has read or write privilege.