Software application verification method and system
View Patent ↗A method for verifying a software application to a user of a device such as a mobile phone. The device receives ( 102 ) the software application, for example a Java ME MIDIet, and checks ( 104 ) a signature associated with the software application. Where the signature is recognized, the phone indicates ( 108 ) this status to the user, for example by displaying the familiar padlock icon. The mobile phone then establishes ( 110 ) a secure code known only to the user and a trusted entity, the entity being for example the manager of the Java ME environment. The device identifies ( 114 ) the software application to the trusted entity which then checks ( 116 ) the status of the software application. If the status is verified, the entity sends ( 118 ) the status to the device; which in turn indicates ( 120 ) the secure code to the user, for example as an additional displayed number, pictogram or the like.
1. A method for verifying a software application to a user of a device, comprising:
receiving the software application;
checking a signature associated with the received software application;
where the checked signature is issued by a recognized authority, indicating this status to the user;
establishing a secure code known only to the user and a trusted entity, wherein the secure code is based on user input, identifying the received software application to the trusted entity;
checking the status of the identified software application by the trusted entity; and
where the checked software application status is verified: sending the indicated status to the device; and indicating the secure code to the user after the trusted entity determines that the identified software application is a trusted application.
2. The method as claimed in claim 1 , wherein the establishing step comprises: inputting a Personal Identification Number (PIN) code at the device; sending the PIN code to the trusted entity; calculating the secure code in dependence on the PIN code, the calculation being performed using a secure algorithm under control of the trusted entity;
and sending the secure code to the device.
3. The method as claimed in claim 2 , wherein the device is a mobile telephone and sending the secure code to the device is by means of a Short Message Service (SMS) message.
4. The method as claimed in claim 1 , wherein the trusted entity manages a software operating environment of the device.
5. A system for verifying a software application, the system comprising:
a user device;
a software applications server;
a trusted entity server;
a first communications link operable to communicate with the software applications server;
a second communications link operable to communicate with the trusted entity server; the user device further comprising: a processor, a display, a user interface, program memory, data memory and interfaces to connect to respective first and second communications links; the processor operable to receive the software application from the software applications server using the first communications link;
check a signature associated with the received software application, where the checked signature is issued by a recognized authority, indicate this status to the user by means of the user interface or display; using the second communication link,
establish a secure code known only to the user and the trusted entity, wherein the secure code is based on user input, and identify the received software application to the trusted entity;
and indicate, by user interface or display, the secure code to the user where the status is verified;
and the trusted entity server is operable to check the status of the received software application;
and where the status is verified, send the status to the device.
6. A user device for use in the system as claimed in claim 5 , wherein the device is a mobile telephone.
7. A user device for use in the system as claimed in claim 5 , wherein the device operates under control of Java Micro Edition (ME) Java ME.
8. The user device as claimed in claim 6 , wherein the device operates under control of Java Micro Edition (ME).
9. The method of claim 1 , further comprising: indicating the secure code to the user as an audible report.
10. The method of claim 1 , further comprising: indicating the secure code to the user as a number code.
11. The method of claim 1 , further comprising: indicating the secure code to the user as an icon.
12. The method of claim 1 , further comprising: indicating the secure code to the user as a pictogram.
13. The method of claim 1 , wherein the secure code is unique to each user.
14. The method of claim 1 , further comprising: displaying the secure code in a status bar.
15. The system of claim 5 , wherein the indicated secure code is an audible report.
16. The system of claim 5 , wherein the indicated secure code is a number code.
17. The system of claim 5 , wherein the indicated secure code is an icon.
18. The system of claim 5 , wherein the indicated secure code is a pictogram.
19. The system of claim 5 , wherein the secure code is unique to each user.
20. The system of claim 5 , wherein the secure code is displayed in a status bar.