Virtual distributed security system

• US 8,302,149 B2
• Filed: 10/20/2005
• Issued: 10/30/2012
• Est. Priority Date: 10/16/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Della-Libera, Giovanni M., Kaler, Christopher G., Konersmann, Scott A., Lampson, Butler W., Leach, Paul J., Lovering, Bradford H., Lucco, Steven E., Millet, Stephen J., Rashid, Richard F., Shewchuk, John P.
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Lavelle, Gary
• Application Number:
  US11/254,519
• Publication Number:
  US 20060041929A1
• Time in Patent Office: 2,567 Days
• Field of Search: 713/151, 726/1
• US Class Current: 726/1
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A distributed security system is provided. The distributed security system uses a security policy that is written in a policy language that is transport and security protocol independent as well as independent of cryptographic technologies. This security policy can be expressed using the language to create different security components allowing for greater scalability and flexibility. By abstracting underlying protocols and technologies, multiple environments and platforms can be supported.

Claims

1. A method of defining a security arrangement between entities of a distributed computing system, the method including:

identifying a portion of a first security policy written in a first security policy language;

identifying a portion of a second security policy written in a second security policy language;

one or more computer processors processing data in accordance with the portion of the first security policy and the portion of the second security policy; and

exchanging messages between the entities to negotiate on the identification of the portion of the first security policy and the portion of the second security policy.

2. The method of claim 1, wherein the first security policy language is the same as the second security policy language.

3. The method of claim 1, wherein:

the first security policy identifies components of the security system.

4. The method of claim 1, wherein:

the first security policy identifies access rights of the security system.

5. The method of claim 1, wherein:

the first security policy language comprises the extensible markup language.

6. The method of claim 1, wherein:

the first security policy is configurable.

7. The method of claim 1, wherein:

the first security policy language comprises at least some logic-based components.

8. The method of claim 1, wherein:

the first security policy language comprises at least some rule-based components.

9. The method of claim 1, wherein:

the first security policy language comprises procedural components.

10. The method of claim 1, wherein the first security policy includes an identity service.

11. The method of claim 1, wherein the first security policy includes an admission service.

12. The method of claim 1, wherein the first security policy includes a permission service.

13. The method of claim 1, wherein the first security policy includes a revocation service.

14. The method of claim 1, wherein the first security policy includes a mapping of entities to rights.

15. The method of claim 14, wherein the first security policy further includes a mapping of entities to capabilities.

16. A method of defining a security arrangement between entities of a distributed computing system, the method including:

identifying a portion of a first security policy written in a first security policy language;

identifying a portion of a second security policy written in a second security policy language;

one or more computer processors processing data in accordance with the portion of the first security policy and the portion of the second security policy;

exchanging messages between the entities to negotiate on the identification of the portion of the first security policy and the portion of the second security policy; and

wherein the first security policy includes a revocation service which monitors the use of credentials for revocation, wherein a credential is revoked upon exceeding a use limit according to the security policy, and wherein the use limit is one or more of a call limit and a frequency limit, the call limit being a maximum number of times a credential may be used and the frequency limit being a maximum number of times a credential may be used within a particular time period.

17. A computer program product for implementing a method of defining a security arrangement between entities of a distributed computing system, the computer program product comprising one or more hardware computer-readable storage devices having encoded thereon computer-executable instructions which, when executed upon one or more computer processors, perform the method including:

identifying a portion of a first security policy written in a first security policy language;

identifying a portion of a second security policy written in a second security policy language;

processing data in accordance with the portion of the first security policy and the portion of the second security policy; and

exchanging messages between the entities to negotiate on the identification of the portion of the first security policy and the portion of the second security policy.