PROJECT MANAGEMENT BLACK BOX PROTECTIONS

• US 20090030705A1
• Filed: 07/23/2007
• Published: 01/29/2009
• Est. Priority Date: 07/23/2007
• Status: Abandoned Application

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Lowry, Lee Edward, Simpson, Michel Shane, Carter, Stephen R., Street, William, Scheuber-Heinz, Volker Gunnar
• Application Number:
  US11/781,325
• Publication Number:
  US 20090030705A1
• Time in Patent Office: Days
• US Class Current: 705/301
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management

Abstract

Techniques for project management black box protections are provided. A first principal associated with a first processing environment and a first stage of a project'"'"'s lifecycle requests that an action be taken on its behalf. The first principal is authenticated and policy is evaluated when the first principal is successfully authenticated. Moreover, the action is taken on behalf of the principal when the policy permits and the when the principal was successfully authenticated.

Claims

1. A method, comprising:

receiving a request from a first principal to take an action on behalf of the first principal within a first processing environment, wherein the request is received within a context of a first stage for a lifecycle of a project;

authenticating the first principal;

evaluating policy when the first principal is successfully authenticated; and

taking the action on behalf of the first principal when policy permits.

2. The method of claim 1, wherein receiving further includes receiving the request in response to evaluation of a first stage policy that indicates the action being attempted by the first principal is associated with access to a sensitive resource for which third-party processing intervention is called for and raising the request to prompt that third-party processing.

3. The method of claim 1, wherein receiving the request further includes recognizing the action as one or more of the following:

requesting access to confidential data;

requesting access to a private service;

requesting access to a secure device;

requesting permission to transition from the first stage of the project to a second stage of the project;

requesting permission to transition from the first stage back to a previous stage of the lifecycle for the project, wherein the previous stage preceded the first stage in the lifecycle; and

requesting remote action from a down stage or upstage secure resource.

4. The method of claim 1, wherein authenticating further includes using an authentication policy to determine an authentication mechanism to use for authenticating the first principal.

5. The method of claim 1, wherein authenticating further includes enlisting a third-party identity service to perform the authentication of the first principal.

6. The method of claim 1, wherein taking further includes:

dynamically authenticating to a down stage or upstage secure resource located in a second processing environment as part of taking the action on behalf of the first principal; and

requesting that the secure resource take one or more additional actions.

7. The method of claim 1, wherein taking further includes accessing a secure resource within the first processing environment to acquire an access key and supplying the access key to the first principal.

8. A method, comprising:

detecting an attempt made by a first principal in a first processing environment to promote a project from a first stage of its lifecycle to a second stage of its lifecycle;

determining in response to a first policy evaluation that the attempt has to be made by a second principal;

requesting that the second principal authorize the transition of the project from the first stage to the second stage by interacting with a third principal associated with the a second processing environment of the second stage.

9. The method of claim 8 further comprising, transitioning the project to the second stage upon receiving an authorization key from the second principal.

10. The method of claim 8 further comprising, permitting the second principal and the third principal to transition the project on behalf of the first principal upon authorization.

11. The method of claim 8, wherein determining further includes performing additional authentication against the first principal, wherein the first principal is already authenticated within the first processing environment and the additional authentication is dictated by the first policy in response to the project transition attempt being made by the first principal.

12. The method of claim 11 further comprising, dynamically acquiring additional credentials from the first principal while performing the additional authentication.

13. The method of claim 8, wherein determining further includes acquiring the first policy from a third-party identity service in response to identities associated with one or more of the following:

the first stage, the first principal, the first processing environment, the second stage, the second principal, and the second processing environment.

14. The method of claim 8, wherein requesting further includes independently having the second principal and the third principal authenticate them selves to the third-party identity service before interacting with one another.

15. A system, comprising:

a project black box first security service implemented in a machine-accessible and readable medium and to process on a machine within a first processing environment of a network; and

a project black box second security service implemented in a machine-accessible and readable medium and to process on a different machine within a second processing environment of the network;

wherein the project black box first security service facilitates transitioning a project from a first stage of its lifecycle within the first processing environment to a second stage of its lifecycle within the second processing environment by interacting with the project black box second security service, actions of the project black box first security service are triggered in response to policy evaluation vis-à

-vis a first principal operating within the first processing environment when an attempt is made by the first principal to transition the project from the first stage to the second stage.

16. The system of claim 15, wherein the project black box first security service also manages and distributes sensitive data within the first processing environment by enforcing access policies.

17. The system of claim 15 further comprising, an identity service implemented in a machine-accessible and readable medium and to process on its own independent machine within a third processing environment of the network, wherein the identity service independently authenticates the project black box first security service and the project black box second security service for interacting with one another.

18. The system of claim 17, wherein the identity service manages and distributes the policy evaluated by the project black box first security service in response to an identity assigned to the first principal.

19. The system of claim 15, wherein the project black box first security service utilizes a first authentication mechanism to authenticate and interact with first resources of the first processing environment and the project black box second security service utilizes a second authentication mechanism to authenticate and interact with second resources of the second processing environment, and wherein the first and second authentication mechanisms are independent of one another and different from one another.

20. The system of claim 15, wherein the project black box first security service dynamically requests additional credentials from the first principal when the first principal attempts to transition the project from the first stage to the second stage.

21. A system, comprising:

a project black box first security service implemented in a machine-accessible and readable medium and to process within a first processing environment of a network; and

a project lifecycle management service implemented in a machine-accessible and readable medium and to process with the first processing environment of the network;

wherein the project lifecycle management service is to monitor activities of a first principal within the first processing environment with respect to a first policy and when dictated by the first policy invoke the project black box first security service to perform a lifecycle management operation on behalf of the first principal.

22. The system of claim 21, wherein the lifecycle management operation includes one or more of the following:

acquiring an access key for access to a secure resource, acquiring confidential data from the secure resource, requesting that the secure resource perform one or more actions, and promoting a project associated with the first principal from a first stage to a second stage located in a second processing environment.

23. The system of claim 21, wherein the project lifecycle management service interacts with an identity service to acquire the first policy and to acquire authentication services for the first principal and the project black box first security service.

24. The system of claim 21, wherein the project lifecycle management service requests that the first principal supply additional credentials beyond what was previously supplied when the first policy dictates and when the lifecycle management operation is associated with promoting a project from a first stage of its lifecycle to a second stage of its lifecycle.

25. The system of claim 21, wherein the project black box first security service interacts with a project black box second security service associated with a second and different processing environment to perform the lifecycle management operation on behalf of the first principal.