Software authorization utilizing software reputation
View Patent ↗Software is authorized in accordance with a reputation of the software. A trust in the author and/or publisher of the software is determined via digital signatures and/or CoAs, and a reputation of the software is utilized to determine the intent of the software. The reputation of the software can be determined via a local service, such as an enterprise IT department and/or via a reputation determination service. When software is downloaded or to be executed, the trust in the author/publisher is determined using digital signatures and/or CoAs associated with the software. If the author/publisher is determined to be trusted, a service is called to determine the reputation of the software. The software can be installed and/or executed dependent upon the reputation of the software and trustworthiness of the author/publisher.
1. A method comprising:
receiving software;
determining an intermediate reputation of the software based on:
community voting comprising comments about the software;
statistics pertaining to the software; and
a reputation of other software, wherein execution of the software results in interaction with the other software;
determining a reputation of the software by forming a weighted aggregation of the intermediate reputation with at least one other reputation;
determining a trustworthiness of at least one of:
a publisher of the software; or
an author of the software;
determining that the software is acceptable when:
the reputation is acceptable; and
at least one of the publisher or the author is trusted.
2. The method of claim 1 , further comprising generating a certificate that permits the software to be digitally signed.
3. The method of claim 1 , wherein the trustworthiness is determined cryptographically.
4. The method of claim 1 , wherein the reputation of the software is further based on a reputation of a name assigned to the software.
5. An apparatus comprising:
a processor; and
memory coupled to the processor, the memory comprising executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
receiving software;
determining an intermediate reputation of the software based on:
community voting comprising comments about the software;
statistics pertaining to the software; and
a reputation of other software, wherein execution of the software results in interaction with the other software;
determining a reputation of the software by forming a weighted aggregation of the intermediate reputation with at least one other reputation;
determining a trustworthiness of at least one of:
a publisher of the software; or
an author of the software;
determining that the software is acceptable when:
the reputation is acceptable; and
at least one of the publisher or the author is trusted.
6. The apparatus of claim 5 , the operations further comprising rendering an indication of the reputation.
7. The apparatus of claim 5 , wherein the trustworthiness is cryptographically determined.
8. The apparatus of claim 7 , the operations further comprising identifying at least one of the publisher or the author.
9. The apparatus of claim 5 , the operations further comprising generating a certificate that permits the software to be digitally signed.
10. The apparatus of claim 9 , the operations further comprising receiving, from a reputation determination service, in response to a request, the at least one other reputation.
11. The apparatus of claim 9 , wherein the trustworthiness is determined cryptographically.
12. The apparatus of claim 5 , wherein the received software has a good reputation and the good reputation is tarnished upon detecting that the received software has associated with software having a bad reputation, the tarnishing reflected thereon in a change of the good reputation to a bad reputation.
13. The apparatus of claim 5 , wherein determining a reputation of the received software further comprises determining if the received software has been affected by association, the association comprising the received software accessing a uniform resource identifier for downloading malware.
14. The apparatus of claim 13 , wherein the received software had a good reputation prior to accessing the uniform resource identifier, and the good reputation is changed to a bad reputation as a result of the accessing.
15. The apparatus of claim 5 , wherein the reputation is determined by a reputation determination service.
16. A computer-readable storage medium, the storage medium not being a transient signal, the storage medium having computer-executable instructions stored thereon that when executed by a processor cause the processor to effectuate operations comprising:
receiving software;
determining an intermediate reputation of the software based on:
community voting comprising comments about the software;
statistics pertaining to the software; and
a reputation of other software, wherein execution of the software results in interaction with the other software;
determining a reputation of the software by forming a weighted aggregation of the intermediate reputation with at least one other reputation;
determining a trustworthiness of at least one of:
a publisher of the software; or
an author of the software;
determining that the software is acceptable when:
the reputation is acceptable; and
at least one of the publisher or the author is trusted.
17. The computer-readable storage medium of claim 16 , wherein the community voting is based on at least one of a code signing ecosystem in which a code developer and a user can digitally sign code, the user digitally signing the code using a certificate issued by the code developer, or user-provided statistics comprising a first number of users that blocked the software package, and a second number of users that downloaded the software package.
18. The computer-readable storage medium of claim 16 , wherein the reputation is determined by a reputation determination service.