Virtual distributed security system

1. In a distributed computing system environment that includes a plurality of computing devices that each comprise a processor and system memory, a method of transmitting a message within a generic security framework, wherein the generic security framework is architecture, transport, and cryptographic technology independent, the method comprising:

receiving from a first entity a message addressed to a second entity, wherein the message is transported with a first transport and formatted in accordance with a first cryptographic technology;

determining that the message is to be transmitted to the second entity;

a processor identifying a second transport and a second cryptographic technology required by the second entity from a modular security policy, wherein the modular security policy:

establishes security rules and procedures of the generic security framework;

implements a security policy of the generic security framework with one or more protocols and transports; and

describes security aspects, including properties, capabilities, requirements and interaction semantics, of a plurality of modular security components which define behaviors corresponding to use of transports and cryptographic technologies by the first and second entities and which are written in a security policy language as selectable, deployable and combinable security modules thereby enabling the modular security components to be negotiated, partitioned and modified, rather than being hard-coded, and which include:

an identity component for authenticating a principal and providing authoritative proof of identity;

an admission component for mapping external credentials to internal credentials;

a permission component for pre-fetching rights, capabilities and access control information; and

a store component for storing, retrieving, encrypting, and managing credentials; and

transmitting the message to the second entity using the transport and cryptographic technology required by the second entity.

2. The method of claim 1 , wherein:

the security policy identifies access rights of the security system.

3. The method of claim 1 , wherein:

the security policy language comprises the extensible markup language.

4. The method of claim 1 , wherein:

the security policy is configurable.

5. The method of claim 1 , wherein:

the security policy language comprises at least some logic-based components.

6. The method of claim 1 , wherein:

the security policy language comprises at least some rule-based components.

7. The method of claim 1 , wherein:

the security policy language comprises procedural components.

8. The method of claim 1 , wherein the security policy includes a revocation service.

9. The method of claim 1 , wherein the security policy includes a mapping of entities to rights.

10. The method of claim 9 , wherein the security policy further includes a mapping of entities to capabilities.

11. A computer program product for use at a computer system, the computer program product for implementing a method for transmitting a message within a generic security framework, wherein the generic security framework is architecture, transport, and cryptographic technology independent, the computer program product comprising one or more computer-readable storage device having stored thereon computer-executable instructions that, when executed at a processor, cause the computer system to perform the method, including the following:

receive from a first entity a message addressed to a second entity, wherein the message is transported with a first transport and formatted in accordance with a first cryptographic technology;

determine that the message is to be transmitted to the second entity;

identify a second transport and a second cryptographic technology required by the second entity from a modular security policy, wherein the modular security policy:

establishes security rules and procedures of the generic security framework;

implements a security policy of the generic security framework with one or more protocols and transports; and

describes security aspects, including properties, capabilities, requirements and interaction semantics, of a plurality of modular security components which define behaviors corresponding to use of transports and cryptographic technologies by the first and second entities and which are written in a security policy language as selectable, deployable and combinable security modules thereby enabling the modular security components to be negotiated, partitioned and modified, rather than being hard-coded, and which include:

an identity component for authenticating a principal and providing authoritative proof of identity;

an admission component for mapping external credentials to internal credentials;

a permission component for pre-fetching rights, capabilities and access control information; and

a store component for storing, retrieving, encrypting, and managing credentials; and

transmit the message to the second entity using the transport and cryptographic technology required by the second entity.

12. The computer program product of claim 11 , wherein:

the security policy identifies access rights of the security system.

13. The computer program product of claim 11 , wherein:

the security policy language comprises the extensible markup language.

14. The computer program product of claim 11 , wherein:

the security policy is configurable.

15. The computer program product of claim 11 , wherein:

the security policy language comprises at least some logic-based components.

16. The computer program product of claim 11 , wherein:

the security policy language comprises at least some rule-based components.

17. The computer program product of claim 11 , wherein:

the security policy language comprises procedural components.

18. The computer program product of claim 11 , wherein the security policy includes a revocation service.

19. The computer program product of claim 11 , wherein the security policy includes a mapping selected from among the list of: (a) a mapping of entities to rights and (b) a mapping of entities to capabilities.

20. A computer system, the computer system comprising:

one or more processors;

system memory; and

one or more computer-readable storage media having stored thereon computer-executable instructions representing a virtual distributed security system, wherein the virtual distributed security system is configured to:

receive from a first entity a message addressed to a second entity, wherein the message is transported with a first transport and formatted in accordance with a first cryptographic technology;

determine that the message is to be transmitted to the second entity;

identify a second transport and a second cryptographic technology required by the second entity from a modular security policy, wherein the modular security policy:

establishes security rules and procedures of a generic security framework;

implements a security policy of the generic security framework with one or more protocols and transports; and

describes security aspects, including properties, capabilities, requirements and interaction semantics, of a plurality of modular security components which define behaviors corresponding to use of transports and cryptographic technologies by the first and second entities and which are written in a security policy language as selectable, deployable and combinable security modules thereby enabling the modular security components to be negotiated, partitioned and modified, rather than being hard-coded, and which include:

an identity component for authenticating a principal and providing authoritative proof of identity;

an admission component for mapping external credentials to internal credentials;

a permission component for pre-fetching rights, capabilities and access control information; and

a store component for storing, retrieving, encrypting, and managing credentials; and

transmit the message to the second entity using the transport and cryptographic technology required by the second entity.