System and method of cryptographically signing web applications

1. A method, comprising:

receiving a minimal bootstrap payload from an application server;

storing the minimal bootstrap payload in a local cache,

receiving an application from an application server; wherein

the locally cached minimal bootstrap payload is executed before executing the application from the application server;

the cache comprises a locally stored public key received by the application server and stored in the local cache

the minimal bootstrap payload includes at least one public key;

executing the minimal bootstrap payload, which comprises:

receiving an application code payload from the URL specified by the minimal bootstrap payload, wherein the received application code payload includes a cryptographic signature using a private key associated with the public key specified by the minimal bootstrap payload;

verifying the received application code payload cryptographic signature using the locally stored public key;

executing the received application code payload after the received application payload has been successfully verified,

wherein the minimal bootstrap payload includes at least two public keys and further comprises verifying, by the client-side processor, the received application code payload.

2. The method of claim 1 , wherein the minimal bootstrap payload further comprises:

Storing in the local cache a copy of the verified application code payload; and

executing the local cache copy of the verified application code payload when the minimal bootstrap payload fails to verify the received application code payload.

3. The method of claim 1 , wherein at least one of the minimal bootstrap payload and the application code payload are written using a combination of HyperText Markup Language (HTML), Cascading Style Sheets (CSS) and JavaScript (JS).

4. The method of claim 1 , wherein the minimal bootstrap payload includes a backup URL and further comprises receiving a backup application code payload from a backup URL when the minimal bootstrap payload fails to verify the received application code payload.

5. The method of claim 1 , wherein the minimal bootstrap payload includes a second URL and further comprises:

receiving a pre-computed hash from the second URL,

verifying the received pre-computed hash has using the locally stored public key; and

storing in the local cache a copy of the verified pre-computed hash.

6. The method of claim 5 , wherein the minimal bootstrap payload further comprises computing a hash of the received application code payload.

7. The method of claim 6 , wherein the minimal bootstrap payload further comprises comparing the computed hash of the received application code payload with the local cache a copy of the verified pre-computed hash.

8. The method of claim 1 , wherein the minimal bootstrap payload includes a backup URL and further comprises receiving a backup application code payload from a backup URL when the minimal bootstrap payload fails to verify the received application code payload.

9. A method, comprising:

receiving a minimal bootstrap payload from an application server;

storing the minimal bootstrap payload in a local cache,

receiving an application from an application server; wherein

the locally cached minimal bootstrap payload is executed before executing the application from the application server,

the minimal bootstrap payload includes at least one public key and at least one Uniform Resource Location (URL) address of an application code payload, and

the cache comprises a locally stored public key previously received by the application server and stored in the local cache;

executing the minimal bootstrap payload, which comprises:

receiving an application code payload from the URL specified by the minimal bootstrap payload;

verifying the received application code payload;

executing the received application code payload after the received application payload has been successfully verified,

wherein the minimal bootstrap payload includes at least two public keys and further comprises verifying, by the client-side processor, the received application code payload.

10. The method of claim 9 , wherein the minimal bootstrap payload further comprises:

storing in the local cache a copy of the verified application code payload; and

executing the local cache copy of the verified application code payload when the minimal bootstrap payload fails to verify the received application code payload.

11. The method of claim 9 , wherein at least one of the minimal bootstrap payload and the application code payload are written using a combination of HyperText Markup Language (HTML), Cascading Style Sheets (CSS) and JavaScript (JS).

12. The method of claim 9 , wherein the minimal bootstrap payload includes a second URL and further comprises:

receiving a pre-computed hash from the second URL,

verifying the received pre-computed hash has using the locally stored public key; and

storing in the local cache a copy of the verified pre-computed hash.

13. The method of claim 12 , wherein the minimal bootstrap payload further comprises computing a hash of the received application code payload.

14. The method of claim 13 , wherein the minimal bootstrap payload further comprises comparing the computed hash of the received application code payload with the local cache a copy of the verified pre-computed hash.

15. A non-transitory computer readable medium, instructing an computing device to execute a method comprising:

receiving a minimal bootstrap payload from an application server;

storing the minimal bootstrap payload in a local cache, wherein

the local cache comprises a locally stored public key previously received by the application server and stored in the local cache;

the locally cached minimal bootstrap payload is executed before executing an application from the application server;

the minimal bootstrap payload includes at least one public key and at least one Uniform Resource Location (URL) address of an application code payload;

executing the minimal bootstrap payload, which comprises:

receiving an application code payload from the URL specified by the minimal bootstrap payload;

verifying the received application code payload;

executing the received application code payload after the received application payload has been successfully verified,

wherein the minimal bootstrap payload includes at least two public keys and further comprises verifying, by the client-side processor, the received application code payload.

16. The non-transitory computer readable medium of claim 15 , wherein the minimal bootstrap payload further comprises:

storing in the local cache a copy of the verified application code payload; and

executing the local cache copy of the verified application code payload when the minimal bootstrap payload fails to verify the received application code payload.

17. The non-transitory computer readable medium of claim 15 , wherein the minimal bootstrap payload includes a backup URL and further comprises receiving a backup application code payload from a backup URL when the minimal bootstrap payload fails to verify the received application code payload.

18. The non-transitory computer readable medium of claim 15 , wherein the minimal bootstrap payload includes a second URL and further comprises:

receiving a pre-computed hash from the second URL,

verifying the received pre-computed hash has using the locally stored public key; and

storing in the local cache a copy of the verified pre-computed hash.

19. The non-transitory computer-readable medium of claim 18 , wherein the minimal bootstrap payload further comprises computing a hash of the received application code payload.

20. The non-transitory computer-readable medium of claim 19 , wherein the minimal bootstrap payload further comprises comparing the computed hash of the received application code payload with the local cache a copy of the verified pre-computed hash.