Verifying measurable aspects associated with a module

A computer program product for use in a computer system, the computer system connected to one or more other computer systems via a computer network, the computer system also including a distributed application component of a distributed application, one or more other distributed application components of the distributed application being included at the one or more other computer systems, the distributed application component and the one or more other distributed application components configured to interoperate to implement the functionality of the distributed application, the computer system and each of the one or more other computer systems having computer system measurable aspects indicating a configuration for use in machine authentication, the distributed application component and each of the one or more other distributed application components having application measurable aspects indicating a configuration for use in application authentication, the computer program product for implementing a method for providing information that can be used to securely verify measurable aspects of the distributed application component, the computer program product comprising one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by a processer, cause the computer system to perform the method, including following:

• send communication to another computer system, the other computer system selected from among the one or more other computer systems, the communication requesting access to a resource under the control of another distributed application component, selected from among the one or more other distributed application components, at the other computer system;
• conduct application authentication with the other distributed application component so that the computer system can verify the identity of the other distributed application component, application authentication including the computer system receiving proof from the other distributed application component that the other distributed application component complies with one or more security policies of the computer system;
• the computer system accessing information that indicates how to prove an appropriate configuration, from among one or more appropriate configurations, to access the resource in accordance with the one or more security policies subsequent to and in response to successfully conducting application authentication, the accessed information indicating that one or more application measurable aspects of the distributed application component and one or more computer system measurable aspects of the computer system are to be verified to prove that the combination of the distributed application component and the computer system provide an appropriate configuration to interoperate with the other distributed application component to access the resource;
• formulate an assertion that can used to verify the one or more application measurable aspects and the one or more computer system measurable aspects, the assertion representing identity values for the one or more application measureable aspects and representing environment values for the one or more computer system measurable aspects, the identity values expressly indicating the identity and the functionality of portions of computer-executable instructions included the distributed application component, the environment values identifying the execution environment at the computer system;
• and
• send the formulated assertion for verification.

A computer system, the computer system comprising:

• system memory;
• one or more processors;
• and
• one or more computer-readable media having stored thereon computer-executable instructions representing an application authentication module, a machine authentication module, and a distributed application component of a distributed application, wherein the machine authentication module configured to:
• conduct machine authentication with other computer systems, including establishing a Secure Sockets Layer (SSL) connection between the computer system and the other computer systems;
• wherein the application authentication module is configured to:
• conduct application authentication with other distributed application components of the distributed application at other computer systems after the other computer systems have been authenticated using machine authentication so that the computer system can verify the identity of the other distributed application components, application authentication including the computer system receiving proof from the other distributed application components that the other distributed application components comply with one or more security policies of the computer system;
• and
• wherein the distributed application component is configured to:
• send communication to other computer systems that include a distributed application component for the distributed application, the communication requesting access to a resource under the control of another distributed application component at the other computer system;
• access information that indicates how to prove an appropriate configuration, from among one or more appropriate configurations, to access the resource in accordance with the one or more security policies subsequent to and in response to successfully conducting application authentication, the accessed information indicating that one or more application measurable aspects of the distributed application component, including access to specified byte values from within specified locations in computer-executable instructions of the distributed application, and one or more computer system measurable aspects of the computer system, including specified values for specified execution environment variables, are to be verified to prove that the combination of the distributed application component and the computer system provide an appropriate execution environment for interoperating with the other distributed application component to access the resource;
• formulate an assertion that can used to verify the one or more application measurable aspects and the one or more computer system measurable aspects, the assertion including the specified byte values from within the specified locations in computer-executable instructions and the specified values for the specified execution environment variables;
• send the formulated assertion for verification;
• receive a token representing that the combination of the distributed application component and the computer system do provide an appropriate execution environment for interoperating with the other distributed application component to access the resource;
• and
• submit the token to the other computer system so that the other computer system can verify that the combination of the distributed application component and the computer system do provide an appropriate execution environment for accessing the resource based on the context of the token.