Code signing system and method
A novel code signing system, computer readable media, and method are provided. The code signing method includes receiving a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs). A digital signature is provided to the requestor. The digital signature indicates authorization by a code signing authority for code of the requestor to access the one or more specific APIs. In one example, the digital signature is provided by the code signing authority or a delegate thereof. In another example, the code signing request may include one or more of the following: code, an application, a hash of an application, an abridged version of the application, a transformed version of an application, a command, a command argument, and a library.
1. A mobile device comprising:
one or more hardware processors enabled to receive a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device;
at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, and wherein the signed application comprises a digital signature generated by a device external to the mobile device; and
at least one non-sensitive API, wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
2. The mobile device of claim 1 , wherein the signed application is signed using a private key.
3. The mobile device of claim 2 , wherein the private key is stored by the code signing authority.
4. The mobile device of claim 1 , wherein the signed application is signed using a hash of a software application, the software application being comprised in code.
5. The mobile device of claim 1 , wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code.
6. The mobile device of claim 1 , wherein the one or more hardware processors enabled are further enabled to verify the digital signature of the signed application using a corresponding public key.
7. The mobile device of claim 6 , wherein the corresponding public key is associated with a manufacturer of the mobile device.
8. A method implemented in a mobile device, the method comprising:
receiving a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device,
wherein the mobile device comprises at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, wherein the signed application comprises a digital signature generated by a device external to the mobile device, wherein the mobile device further comprises at least one non-sensitive API, and wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
9. The method of claim 8 , wherein the signed application is signed using a private key.
10. The method of claim 9 , wherein the private key is stored by the code signing authority.
11. The method of claim 8 , wherein the signed application is signed using a hash of a software application, the software application being comprised in code.
12. The method of claim 8 , wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code.
13. The method of claim 8 , further comprising verifying the digital signature of the signed application using a corresponding public key.
14. The method of claim 13 , wherein the corresponding public key is associated with a manufacturer of the mobile device.
15. A non-transitory computer readable medium storing instructions that when executed by one or more processors of a mobile device, cause the one or more processors to implement a method comprising:
receiving a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device,
wherein the mobile device comprises at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, wherein the signed application comprises a digital signature generated by a device external to the mobile device, wherein the mobile device further comprises at least one non-sensitive API, and wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API.
16. The non-transitory computer readable medium of claim 15 , wherein the signed application is signed using a private key.
17. The non-transitory computer readable medium of claim 16 , wherein the private key is stored by the code signing authority.
18. The non-transitory computer readable medium of claim 15 , wherein the signed application is signed using a hash of a software application, the software application being comprised in code.
19. The non-transitory computer readable medium of claim 15 , wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code.
20. The non-transitory computer readable medium of claim 15 , wherein the method further comprises verifying the digital signature of the signed application using a corresponding public key.