Method and apparatus for facilitating secure extension of an application

1. A method for facilitating secure extension of an application, comprising:

establishing an agreement between an owner of the application and a third party to allow the third party to incorporate an extension into the application;

causing the extension to be digitally signed with a private key associated with the owner of the application, whereby the resulting digital signature can be verified with a corresponding public key to confirm that the extension is authorized to be used with the application; and

configuring the application to operate with extensions signed with the private key, wherein configuring the application involves:

storing a public key associated with the owner of the application in an area accessible to the application, and

incorporating instructions for verifying the authenticity of the extension into the application.

2. The method of claim 1 , wherein causing the extension to be digitally signed involves:

receiving the extension from the third party; and

signing the extension with the private key belonging to the owner of the application.

3. The method of claim 2 , wherein signing the extension involves:

creating a message digest of the extension; and

signing the message digest with the private key belonging to the owner of the application.

4. The method of claim 1 , wherein causing the extension to be digitally signed involves:

issuing a private key to the third party; and

allowing the third party to sign the extension with the private key.

5. The method of claim 1 , wherein configuring the application to operate with signed extensions involves configuring the application to verify that the extension includes a chain of certificates establishing authorization for the extension, wherein a certificate in the chain is signed by an entity that is originally empowered to authorize the extension, and subsequent certificates in the chain are signed by entities that have been delegated power to authorize the extension.

6. The method of claim 1 , wherein the application is an operating system.

7. The method of claim 1 , wherein the application is a platform-independent virtual machine.

8. The method of claim 7 , wherein the platform-independent virtual machine is a Java Virtual Machine.

9. The method of claim 1 , wherein the area accessible to the application is located in read-only memory.

10. The method of claim 1 , wherein the agreement involves payment from the third party to the owner of the application in the form of a licensing fee.

11. The method of claim 1 , wherein the application runs on a memory-constrained computing device.

12. A means for facilitating secure extension of an application, comprising:

an establishment means for establishing an agreement between an owner of the application and a third party to allow the third party to incorporate an extension into the application;

a signing means for causing the extension to be digitally signed with a private key associated with the owner of the application, whereby the resulting digital signature can be verified with a corresponding public key to confirm that the extension is authorized to be used with the application; and

a configuration means for configuring the application to operate with extensions signed with the private key, wherein the configuration means comprises:

a storing means for storing a public key associated with the owner of the application in an area accessible to the application; and

an incorporation means for incorporating instructions for verifying the authenticity of the extension into the application.

13. The means of claim 12 , wherein causing the extension to be digitally signed involves:

a receiving means for receiving the extension from the third party; and

a second signing means for signing the extension with the private key belonging to the owner of the application.

14. The means of claim 13 , wherein signing the extension involves:

a digesting means for creating a message digest of the extension; and

a third signing means for signing the message digest with the private key belonging to the owner of the application.

15. The means of claim 12 , wherein causing the extension to be digitally signed involves:

an issuing means for issuing a private key to the third party; and

a second signing means allowing the third party to sign the extension with the private key.

16. The means of claim 12 , wherein configuring the application to operate with signed extensions further comprises a second configuration means for configuring the application to verify that the extension includes a chain of certificates establishing authorization for the extension, wherein a certificate in the chain is signed by an entity that is originally empowered to authorize the extension, and subsequent certificates in the chain are signed by entities that have been delegated power to authorize the extension.

17. The means of claim 12 , wherein the application is an operating system.

18. The means of claim 12 , wherein the application is a platform-independent virtual machine.

19. The means of claim 18 , wherein the platform-independent virtual machine is a Java Virtual Machine.

20. The means of claim 12 , wherein the area accessible to the application is located in read-only memory.

21. The means of claim 12 , wherein the agreement involves payment from the third party to the owner of the application in the form of a licensing fee.

22. The means of claim 12 , wherein the application runs on a memory-constrained computing device.