Securing Distributed Application Information Delivery

• US 20080104666A1
• Filed: 11/01/2006
• Published: 05/01/2008
• Est. Priority Date: 11/01/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dillaway, Blair B.
• Granted Patent: US 8,555,335 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In an example implementation, a data structure comports with a secure application instruction protocol. The data structure includes a first application-level request and a second application-level request. The first application-level request has application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor. The second application-level request has application-specific instructions from an intermediary and an intermediary signature over at least the application-specific instructions from the intermediary.

Claims

1. One or more processor-accessible media including processor-executable instructions, the processor-executable instructions comprising a data structure for a secure application instruction protocol, the data structure including:

a first application-level request comprising application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor; and

a second application-level request comprising application-specific instructions from an intermediary and an intermediary signature over at least the application-specific instructions from the intermediary.

2. The one or more processor-accessible media as recited in claim 1, wherein the first application-level request is nested within the second application-level request.

3. The one or more processor-accessible media as recited in claim 1, wherein the first application-level request further comprises a delegation of rights from the requester to access data.

4. The one or more processor-accessible media as recited in claim 1, wherein the second application-level request further comprises a delegation of rights from the intermediary to access data.

5. The one or more processor-accessible media as recited in claim 4, wherein the intermediary signature is also over the delegation of rights from the intermediary.

6. The one or more processor-accessible media as recited in claim 1, wherein the intermediary signature is also over the first application-level request.

7. The one or more processor-accessible media as recited in claim 1, wherein:

the first application-level request further comprises a delegation of rights for data access from the requestor, and the second application-level request further comprises a delegation of rights for data access from the intermediary;

the first application-level request is nested within the second application-level request; and

the data structure further includes;

a third application-level request comprising application-specific instructions from another intermediary, another intermediary signature over at least the application-specific instructions from the other intermediary, and a delegation of rights for data access from the other intermediary; and

wherein the first application-level request and the second application-level request are nested within the third application-level request.

8. The one or more processor-accessible media as recited in claim 7, wherein each of the delegation of rights for data access comprises delegation information;

and wherein the delegation information is encrypted.

9. A device including an application that implements a secure application instruction protocol, the application comprising:

a message augmenter to encapsulate an incoming application-level request and to add application-specific instructions for a subsequent entity; and

a message signer to digitally sign at least the application-specific instructions for the subsequent entity and to add an outgoing intermediary signature.

10. The device as recited in claim 9, wherein the incoming application-level request comprises application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor.

11. The device as recited in claim 10, wherein the incoming application-level request further comprises application-specific instructions from an intermediary and an intermediary signature over the application-specific instructions from the intermediary.

12. The device as recited in claim 11, further comprising:

an application-specific information extractor to extract the application-specific instructions from the requestor and the application-specific instructions from the intermediary from the incoming application-level request; and

an application-specific information analyzer to analyze the application-specific instructions from the requester and the application-specific instructions from the intermediary to determine an identity for the subsequent entity and to determine application-specific instructions for the subsequent entity.

13. The device as recited in claim 11, further comprising:

a message participant authenticator to authenticate that the application-specific instructions from the requester truly originated from the requestor using the requestor signature and that the application-specific instructions from the intermediary truly originated from the intermediary using the intermediary signature.

14. The device as recited in claim 11, further comprising:

a message information integrity validator to validate that the application-specific instructions from the requester are unmodified since being signed by the requestor using the requester signature and that the application-specific instructions from the intermediary are unmodified since being signed by the intermediary using the intermediary signature.

15. The device as recited in claim 9, wherein the message augmenter is further to add delegation of rights information so that the subsequent entity can access data or further delegate rights to access the data.

16. The device as recited in claim 15, wherein the message signer is to digitally sign the incoming application-level request and the added delegation of rights information to create an outgoing application-level request having the outgoing intermediary signature;

and wherein the device is to forward the outgoing application-level request toward the subsequent entity.

17. A method comprising:

receiving an incoming message having a request that is digitally-signed by a requestor at an application-level;

augmenting the request by adding application-specific instructions for a subsequent entity;

digitally-signing the application-specific instructions to create an outgoing message that includes the request, the application-specific instructions, and a digital signature over the application-specific instructions; and

transmitting the outgoing message towards the subsequent entity.

18. The method as recited in claim 17, wherein the augmenting comprises:

augmenting the request by adding delegation of rights information for the subsequent entity, the delegation of rights information enabling the subsequent entity to access data associated with the request or to further delegate rights to the data.

19. The method as recited in claim 17, further comprising:

extracting application-specific intermediary instructions, which were originated by a previous intermediary, from the request;

extracting application-specific requestor instructions, which were originated by the requestor, from the request; and

analyzing the application-specific intermediary instructions and the application-specific requestor instructions to determine an identity for the subsequent entity.

20. The method as recited in claim 17, further comprising:

extracting application-specific requestor instructions, which were originated by the requestor, and a requester signature from the request;

authenticating that the application-specific requestor instructions were originated by the requestor using the requestor signature; and

validating integrity of the application-specific requestor instructions using the requestor signature.