System and method for registering entities for code signing services

• US 20070074034A1
• Filed: 09/29/2005
• Published: 03/29/2007
• Est. Priority Date: 09/29/2005
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil, Little, Herbert, Tapuska, David, Kirkup, Michael
• Granted Patent: US 7,797,545 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A system and method for registering entities for code signing services. The entities may be software application developers or other individuals or entities that wish to have applications digitally signed. Signing of the applications may be required in order to enable the applications to access sensitive APIs and associated resources of a computing device when the applications are executed on the computing device. In one embodiment, a method of registering entities for code signing services will comprise the step of transmitting at least some account data to the registering individual or entity using an out-of-band communication system. This provides added security that the individual or entity registering for a code signing service is who that individual or entity purports to be.

Claims

1. A method of registering entities for code signing services, the method comprising the steps of:

a) receiving a registration request from an entity requesting registration for code signing services, wherein said registration request includes data associated with the identity of said entity;

b) authenticating the identity of the entity by validating at least a subset of said data in said registration request;

c) generating an account record for the entity, wherein said account record comprises at least a first and a second identifier associated with said entity;

d) transmitting one of the first and second identifiers to said entity via a first communication channel and the other of the first and second identifiers via a different, second communication channel;

e) receiving a registration file from said entity; and

f) confirming that said registration file includes at least both of said first and second identifiers prior to accepting said registration request.

2. The method of claim 1, wherein the first identifier is a client ID and wherein the second identifier is a PIN.

3. The method of claim 2, further comprising the step of generating the client ID and the PIN.

4. The method of claim 2, wherein at least one of the client ID and the PIN are generated by the entity and included in the registration request.

5. The method of claim 1, wherein the data associated with identity of the entity comprises credit card information associated with the entity, and wherein the step of authenticating the identity of the entity comprises validating said credit card information.

6. The method of claim 1, wherein the first communication channel is an SSL connection.

7. The method of claim 6, wherein the second communication channel is one of telephone and fax.

8. The method of claim 1, wherein the registration file comprises a public key associated with the entity, and wherein the method further comprises the step of storing the public key for future verifications in which the public key is used to verify a digital signature received from the entity.

9. A computer-readable medium comprising instructions for performing the steps of the method as claimed in claim 1, wherein said instructions are executable on a computing device.

10. A system for registering entities for code signing services, comprising a client information database for storing a plurality of account records, and a code signing authority application which, when executed on a computing device, performs the steps of the method as claimed in claim 1.