Code signing system and method

• US 10,437,967 B2
• Filed: 07/17/2018
• Issued: 10/08/2019
• Est. Priority Date: 09/21/2000
• Status: Expired due to Fees

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Yach, David Paul, Little, Herbert Anthony, Brown, Michael Stephen
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US16/037,412
• Publication Number:
  US 20180330065A1
• Time in Patent Office: 448 Days
• Field of Search: None
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A novel code signing system, computer readable media, and method are provided. The code signing method includes receiving a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs). A digital signature is provided to the requestor. The digital signature indicates authorization by a code signing authority for code of the requestor to access the one or more specific APIs. In one example, the digital signature is provided by the code signing authority or a delegate thereof. In another example, the code signing request may include one or more of the following: code, an application, a hash of an application, an abridged version of the application, a transformed version of an application, a command, a command argument, and a library.

Claims

1. A code signing method comprising:

receiving, by a code signing authority, code from a developer; and

signing, by the code signing authority, the code;

wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;

wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and

wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.

2. The method of claim 1, wherein signing the code comprises using a private key.

3. The method of claim 2, wherein the private key is stored by the code signing authority.

4. The method of claim 1, wherein signing the code comprises signing a hash of a software application, the software application being comprised in the code.

5. The method of claim 1, further comprising appending a digital signature to the code.

6. The method of claim 1, wherein signing the code comprises signing an abridged version of a software application, the software application being comprised in the code.

7. The method of claim 1, further comprising registering the developer prior to signing the code.

8. The method of claim 7, further comprising determining if a software application was developed by a registered developer.

9. The method of claim 7, further comprising suspending or revoking registration of a registered developer.

10. The method of claim 9, further comprising purging a software application of the registered developer.

11. The method of claim 1, wherein the code signing authority includes any one or more of a manufacturer of the mobile device, an author of the at least one sensitive API, a mobile communication network operator, a service provider, a corporate client, or a representative or delegate of any of the foregoing.

12. The method of claim 1, wherein signing the code comprises applying a private key to a hash of a software application, the software application being comprised in the code.

13. The method of claim 1, wherein signing the code comprises signing a transformed version of a software application, the software application being comprised in the code.

14. A device comprising:

one or more hardware processors enabled to receive, by a code signing authority, code from a developer and sign, by the code signing authority, the code;

wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;

wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and

wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.

15. The device of claim 14, wherein the code is signed using a private key.

16. The device of claim 15, wherein the private key is stored by the code signing authority.

17. The device of claim 14, wherein the code is signed using a hash of a software application, the software application being comprised in the code.

18. The device of claim 14, wherein the one or more hardware processors is further enabled to append a digital signature to the code.

19. The device of claim 14, wherein the code is signed using an abridged version of a software application, the software application being comprised in the code.

20. The device of claim 14, wherein the one or more hardware processors is further enabled to register the developer prior to the code being signed.

21. The device of claim 14, wherein the code is signed using a transformed version of a software application, the software application being comprised in the code.

22. One or more non-transitory computer readable memories comprising instructions that when executed by one or more processors of a device cause the one or more processors to perform instructions comprising:

receiving, by a code signing authority, code from a developer; and

signing, by the code signing authority, the code;

wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;

wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and

wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.

23. The one or more non-transitory computer readable memories of claim 22, wherein signing the code comprises using a private key.

24. The one or more non-transitory computer readable memories of claim 23, wherein the private key is stored by the code signing authority.

25. The one or more non-transitory computer readable memories of claim 22, wherein the code is signed using a hash of a software application, the software application being comprised in the code.

26. The one or more non-transitory computer readable memories of claim 22, wherein the instructions when executed by one or more processors of a device further cause the one or more processors to perform instructions comprising enabling to append a digital signature to the code.

27. The one or more non-transitory computer readable memories of claim 22, wherein the code is signed using an abridged version of a software application, the software application being comprised in the code.

28. The one or more non-transitory computer readable memories of claim 22, wherein the instructions when executed by one or more processors of a device further cause the one or more processors to perform instructions comprising enabling to register the developer prior to the code being signed.

29. The one or more non-transitory computer readable memories of claim 22, wherein the code is signed using a transformed version of a software application, the software application being comprised in the code.