Securing distributed application information delivery
AssigneeMicrosoft Corporation
InventorBlair B. Dillaway
Life of this patent
Estimating the term…
Abstract
In an example implementation, a data structure comports with a secure application instruction protocol. The data structure includes a first application-level request and a second application-level request. The first application-level request has application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor. The second application-level request has application-specific instructions from an intermediary and an intermediary signature over at least the application-specific instructions from the intermediary.
Claims16
One or more processor-accessible memories including processor-executable instructions, the processor-executable instructions comprising a data structure for a secure application instruction protocol, the data structure including:
- a first application-level request comprising application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor, wherein the application-specific instructions from the requestor do not specify a request handler, and wherein the requestor is an initial requestor and the request handler is an end point request handler and not an intermediary;
- and
- a second application-level request comprising application-specific instructions from an intermediary, an intermediary signature over at least the application-specific instructions from the intermediary, and delegation of rights information for the end point request handler, the delegation of rights information enabling the end point request handler to access data associated with the first application-level request or to further delegate rights to the data, wherein the application-specific instructions from the intermediary are dynamically-determined by the intermediary based at least in part on an analysis of the application-specific instructions from the requestor to determine where to forward the first application-level request and determine the end point request handler, wherein the first application-level request is nested within the second application-level request.
A device including an application that implements a secure application instruction protocol, the device comprising:
- one or more processors;
- and
- memory storing computer-executable instructions executable by the one or more processors, the memory storing:
- an application-specific information extractor to receive an incoming application-level request comprising application-specific instructions from a requestor and to extract the application-specific instructions from the requestor, wherein the application-specific instructions from the requestor do not specify an end point request handler, and wherein the requestor is an initial requestor;
- an application-specific information analyzer to analyze the extracted application-specific instructions from the requestor to:
- dynamically determine an identity of a subsequent recipient of the incoming application-level request, and determine additional application-specific instructions for the subsequent recipient;
- a message augmenter to add the additional application-specific instructions for the subsequent recipient and delegation of rights information so that the subsequent recipient can access data or further delegate rights to access the data;
- and
- a message signer to digitally sign at least the additional application-specific instructions for the subsequent recipient, the incoming application-level request and the added delegation of rights information to create an outgoing application-level request, and to add an outgoing intermediary signature to the outgoing application-level request, wherein the device is to forward the outgoing application-level request toward the subsequent recipient.
A computer-implemented method comprising:
- receiving an incoming message having a request that is digitally-signed by a requestor at an application-level, the request comprising application-specific requestor instructions from the requestor, wherein the application-specific requestor instructions from the requestor do not specify a request handler, and wherein the requestor is an initial requestor and the request handler is an end point request handler and not an intermediary;
- analyzing the application-specific requestor instructions;
- based at least in part on the analyzing:
- dynamically determining an identity of a subsequent computing entity, and
- augmenting the request by adding application-specific instructions for the subsequent computing entity and delegation of rights information for the subsequent computing entity, the delegation of rights information enabling the subsequent computing entity to access data associated with the request or to further delegate rights to the data;
- digitally-signing the application-specific instructions for the subsequent computing entity to create an outgoing message that includes the request, the application-specific instructions for the subsequent computing entity, and a digital signature over the application-specific instructions for the subsequent computing entity;
- and
- transmitting the outgoing message towards the subsequent computing entity.
Dependencies are inferred from the claim text.