Code signing system and method
A novel code signing system, computer readable media, and method are provided. The code signing method includes receiving a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs). A digital signature is provided to the requestor. The digital signature indicates authorization by a code signing authority for code of the requestor to access the one or more specific APIs. In one example, the digital signature is provided by the code signing authority or a delegate thereof. In another example, the code signing request may include one or more of the following: code, an application, a hash of an application, an abridged version of the application, a transformed version of an application, a command, a command argument, and a library.
1. A code signing method comprising:
receiving, by a code signing authority, code from a developer; and
signing, by the code signing authority, the code;
wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;
wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and
wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
2. The method of claim 1 , wherein signing the code comprises using a private key.
3. The method of claim 2 , wherein the private key is stored by the code signing authority.
4. The method of claim 1 , wherein signing the code comprises signing a hash of a software application, the software application being comprised in the code.
5. The method of claim 1 , further comprising appending a digital signature to the code.
6. The method of claim 1 , wherein signing the code comprises signing an abridged version of a software application, the software application being comprised in the code.
7. The method of claim 1 , further comprising registering the developer prior to signing the code.
8. The method of claim 7 , further comprising determining if a software application was developed by a registered developer.
9. The method of claim 7 , further comprising suspending or revoking registration of a registered developer.
10. The method of claim 9 , further comprising purging a software application of the registered developer.
11. The method of claim 1 , wherein the code signing authority includes any one or more of a manufacturer of the mobile device, an author of the at least one sensitive API, a mobile communication network operator, a service provider, a corporate client, or a representative or delegate of any of the foregoing.
12. The method of claim 1 , wherein signing the code comprises applying a private key to a hash of a software application, the software application being comprised in the code.
13. The method of claim 1 , wherein signing the code comprises signing a transformed version of a software application, the software application being comprised in the code.
14. A device comprising:
one or more hardware processors enabled to receive, by a code signing authority, code from a developer and sign, by the code signing authority, the code;
wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;
wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and
wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
15. The device of claim 14 , wherein the code is signed using a private key.
16. The device of claim 15 , wherein the private key is stored by the code signing authority.
17. The device of claim 14 , wherein the code is signed using a hash of a software application, the software application being comprised in the code.
18. The device of claim 14 , wherein the one or more hardware processors is further enabled to append a digital signature to the code.
19. The device of claim 14 , wherein the code is signed using an abridged version of a software application, the software application being comprised in the code.
20. The device of claim 14 , wherein the one or more hardware processors is further enabled to register the developer prior to the code being signed.
21. The device of claim 14 , wherein the code is signed using a transformed version of a software application, the software application being comprised in the code.
22. One or more non-transitory computer readable memories comprising instructions that when executed by one or more processors of a device cause the one or more processors to perform instructions comprising:
receiving, by a code signing authority, code from a developer; and
signing, by the code signing authority, the code;
wherein the code signed by the code signing authority is authorized to access at least one sensitive application programming interface (API) on a mobile device on which said code is to be loaded and wherein the code signed by the code signing authority comprises a digital signature which is generated by a device external to the mobile device;
wherein the mobile device includes at least one sensitive API and at least one non-sensitive API; and
wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
23. The one or more non-transitory computer readable memories of claim 22 , wherein signing the code comprises using a private key.
24. The one or more non-transitory computer readable memories of claim 23 , wherein the private key is stored by the code signing authority.
25. The one or more non-transitory computer readable memories of claim 22 , wherein the code is signed using a hash of a software application, the software application being comprised in the code.
26. The one or more non-transitory computer readable memories of claim 22 , wherein the instructions when executed by one or more processors of a device further cause the one or more processors to perform instructions comprising enabling to append a digital signature to the code.
27. The one or more non-transitory computer readable memories of claim 22 , wherein the code is signed using an abridged version of a software application, the software application being comprised in the code.
28. The one or more non-transitory computer readable memories of claim 22 , wherein the instructions when executed by one or more processors of a device further cause the one or more processors to perform instructions comprising enabling to register the developer prior to the code being signed.
29. The one or more non-transitory computer readable memories of claim 22 , wherein the code is signed using a transformed version of a software application, the software application being comprised in the code.