Securing distributed application information delivery

1. One or more processor-accessible memories including processor-executable instructions, the processor-executable instructions comprising a data structure for a secure application instruction protocol, the data structure including:

a first application-level request comprising application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor, wherein the application-specific instructions from the requestor do not specify a request handler, and wherein the requestor is an initial requestor and the request handler is an end point request handler and not an intermediary; and

a second application-level request comprising application-specific instructions from an intermediary, an intermediary signature over at least the application-specific instructions from the intermediary, and delegation of rights information for the end point request handler, the delegation of rights information enabling the end point request handler to access data associated with the first application-level request or to further delegate rights to the data, wherein the application-specific instructions from the intermediary are dynamically-determined by the intermediary based at least in part on an analysis of the application-specific instructions from the requestor to determine where to forward the first application-level request and determine the end point request handler, wherein the first application-level request is nested within the second application-level request.

2. The one or more processor-accessible memories as recited in claim 1 , wherein the first application-level request further comprises a delegation of rights from the requestor to access data.

3. The one or more processor-accessible memories as recited in claim 1 , wherein the intermediary signature is also over the first application-level request.

4. The one or more processor-accessible memories as recited in claim 1 , wherein:

the first application-level request further comprises a delegation of rights for data access from the requestor, and the second application-level request further comprises a delegation of rights for data access from the intermediary;

and

the data structure further includes:

a third application-level request comprising application-specific instructions from another intermediary, another intermediary signature over at least the application-specific instructions from the intermediary, and a delegation of rights for data access from the intermediary; and wherein the first application-level request and the second application-level request are nested within the third application-level request.

5. The one or more processor-accessible memories as recited in claim 4 , wherein each of the delegation of rights for data access comprises delegation information; and wherein the delegation information is encrypted.

6. The one or more processor-accessible memories as recited in claim 1 , wherein the application-specific instructions from the intermediary track identities of participating entities.

7. The one or more processor-accessible memories as recited in claim 1 , wherein the intermediary separates a requested task of the application-specific instructions from the requestor into a plurality of parts and forwards at least a first part to a first request handler and a second part to a second request handler other than the first request handler.

8. A device including an application that implements a secure application instruction protocol, the device comprising:

one or more processors; and

memory storing computer-executable instructions executable by the one or more processors, the memory storing:

an application-specific information extractor to receive an incoming application-level request comprising application-specific instructions from a requestor and to extract the application-specific instructions from the requestor, wherein the application-specific instructions from the requestor do not specify an end point request handler, and wherein the requestor is an initial requestor;

an application-specific information analyzer to analyze the extracted application-specific instructions from the requestor to: dynamically determine an identity of a subsequent recipient of the incoming application-level request, and determine additional application-specific instructions for the subsequent recipient;

a message augmenter to add the additional application-specific instructions for the subsequent recipient and delegation of rights information so that the subsequent recipient can access data or further delegate rights to access the data; and

a message signer to digitally sign at least the additional application-specific instructions for the subsequent recipient, the incoming application-level request and the added delegation of rights information to create an outgoing application-level request, and to add an outgoing intermediary signature to the outgoing application-level request, wherein the device is to forward the outgoing application-level request toward the subsequent recipient.

9. The device as recited in claim 8 , wherein the incoming application-level request comprises a requestor signature over the application-specific instructions from the requestor.

10. The device as recited in claim 9 , wherein the incoming application-level request further comprises application-specific instructions from an intermediary and an intermediary signature over the application-specific instructions from the intermediary.

11. The device as recited in claim 10 , wherein:

the application-specific information extractor is further configured to extract the application-specific instructions from the intermediary from the incoming application-level request; and

the application-specific information analyzer is further configured to analyze the application-specific instructions from the intermediary to: dynamically determine the identity of the subsequent recipient, and determine the additional application-specific instructions for the subsequent recipient.

12. The device as recited in claim 10 , further comprising:

a message participant authenticator to authenticate that the application-specific instructions from the requestor truly originated from the requestor using the requestor signature and that the application-specific instructions from the intermediary truly originated from the intermediary using the intermediary signature.

13. The device as recited in claim 10 , further comprising:

a message information integrity validator to validate that the application-specific instructions from the requestor are unmodified since being signed by the requestor using the requestor signature and that the application-specific instructions from the intermediary are unmodified since being signed by the intermediary using the intermediary signature.

14. A computer-implemented method comprising:

receiving an incoming message having a request that is digitally-signed by a requestor at an application-level, the request comprising application-specific requestor instructions from the requestor, wherein the application-specific requestor instructions from the requestor do not specify a request handler, and wherein the requestor is an initial requestor and the request handler is an end point request handler and not an intermediary;

analyzing the application-specific requestor instructions;

based at least in part on the analyzing:

dynamically determining an identity of a subsequent computing entity, and

augmenting the request by adding application-specific instructions for the subsequent computing entity and delegation of rights information for the subsequent computing entity, the delegation of rights information enabling the subsequent computing entity to access data associated with the request or to further delegate rights to the data;

digitally-signing the application-specific instructions for the subsequent computing entity to create an outgoing message that includes the request, the application-specific instructions for the subsequent computing entity, and a digital signature over the application-specific instructions for the subsequent computing entity; and

transmitting the outgoing message towards the subsequent computing entity.

15. The method as recited in claim 14 , further comprising:

extracting application-specific intermediary instructions, which were originated by a previous intermediary, from the request;

extracting the application-specific requestor instructions, which were originated by the requestor, from the request; and

analyzing the application-specific intermediary instructions and the application-specific requestor instructions to determine the identity of the subsequent computing entity.

16. The method as recited in claim 14 , further comprising:

extracting the application-specific requestor instructions, which were originated by the requestor, and a requestor signature from the request;

authenticating that the application-specific requestor instructions were originated by the requestor using the requestor signature; and

validating integrity of the application-specific requestor instructions using the requestor signature.