Virtual distributed security system

A method of defining a security arrangement between entities of a distributed computing system, the method including:

• identifying a portion of a first security policy written in a first security policy language;
• identifying a portion of a second security policy written in a second security policy language;
• one or more computer processors processing data in accordance with the portion of the first security policy and the portion of the second security policy;
• exchanging messages between the entities to negotiate on the identification of the portion of the first security policy and the portion of the second security policy;
• and
• wherein the first security policy includes a revocation service which monitors the use of credentials for revocation, wherein a credential is revoked upon exceeding a use limit according to the security policy, and wherein the use limit is one or more of a call limit and a frequency limit, the call limit being a maximum number of times a credential may be used and the frequency limit being a maximum number of times a credential may be used within a particular time period.

A computer program product for implementing a method of defining a security arrangement between entities of a distributed computing system, the computer program product comprising one or more hardware computer-readable storage devices having encoded thereon computer-executable instructions which, when executed upon one or more computer processors, perform the method including:

• identifying a portion of a first security policy written in a first security policy language;
• identifying a portion of a second security policy written in a second security policy language;
• processing data in accordance with the portion of the first security policy and the portion of the second security policy;
• and
• exchanging messages between the entities to negotiate on the identification of the portion of the first security policy and the portion of the second security policy.