Controlling access by code
A novel code signing system, computer readable media, and method are provided. The code signing method includes receiving a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs). A digital signature is provided to the requestor. The digital signature indicates authorization by a code signing authority for code of the requestor to access the one or more specific APIs. In one example, the digital signature is provided by the code signing authority or a delegate thereof. In another example, the code signing request may include one or more of the following: code, an application, a hash of an application, an abridged version of the application, a transformed version of an application, a command, a command argument, and a library.
1. A method of controlling access by code to one or more application programming interfaces (APIs) of a device, the method comprising:
determining whether the code includes an authentic digital signature of the code corresponding to one or more APIs of the device, wherein the authentic digital signature is generated by a code signing authority external to the device, the code signing authority being an entity that issues authentic digital signatures; and
controlling access by the code to the one or more APIs depending on whether the code includes the authentic digital signature.
2. The method of claim 1 , further comprising:
purging the code from the device if the code does not include the authentic digital signature.
3. The method of claim 1 , wherein controlling access by the code comprises:
denying the code access to the one or more APIs if the code does not include the authentic digital signature.
4. The method of claim 1 , wherein controlling access by the code comprises:
granting the code access to the one or more APIs if the code includes the authentic digital signature.
5. The method of claim 1 , wherein the authentic digital signature corresponds to a plurality of APIs.
6. The method of claim 1 , wherein the code includes a plurality of digital signatures; and wherein the plurality of digital signatures includes digital signatures corresponding to different APIs.
7. The method of claim 1 , wherein the code includes a plurality of digital signatures; and wherein the plurality of digital signatures includes digital signatures associated with different types of devices.
8. The method of claim 6 , wherein each of the plurality of digital signatures was generated by a respective corresponding code signing authority.
9. The method of claim 8 , wherein each of the plurality of digital signatures was generated by its corresponding code signing authority by applying a respective private key associated with the code signing authority to a hash of the code.
10. The method of claim 1 , wherein the code signing authority includes any one or more of a manufacturer of the device, an author of the one or more APIs, a representative of the manufacturer of the device, or a representative of the author of the one or more APIs.
11. The method of claim 1 , wherein determining whether the code includes the authentic digital signature comprises:
generating a hash of the code to obtain a generated hash;
applying a public key to a digital signature included in the code to obtain a recovered hash, wherein the public key corresponds to a private key used to generate the digital signature; and
comparing the generated hash with the recovered hash.
12. The method of claim 1 , wherein determining whether the code includes the authentic digital signature comprises:
determining whether the code includes an authentic global signature.
13. The method of claim 1 , wherein the code comprises any of the following: a software application, an update to a software application, a command, a command argument, or a library.
14. The method of claim 1 , further comprising:
displaying a message if the code attempts to access the one or more APIs.
15. The method of claim 1 , further comprising:
receiving a user command granting or denying the code access to the one or more APIs.
16. The method of claim 1 , wherein the one or more APIs are associated with one or more libraries, the one or more libraries including a public signature key used to determine whether the code includes the authentic digital signature, the method further comprising:
receiving, at a computing device, a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs); and
providing a digital signature to the requestor, the digital signature indicating authorization by a code signing authority for code of the requestor to access the one or more specific APIs.
17. A computing device comprising:
one or more hardware processors enabled to determine whether code includes an authentic digital signature of the code corresponding to one or more APIs of the computing device, wherein the authentic digital signature is generated by a code signing authority external to the computing device, the code signing authority being an entity that issues authentic digital signatures; and
the one or more hardware processors being further enabled to control access by the code to the one or more APIs depending on whether the code includes the authentic digital signature.
18. The computing device of claim 17 , the one or more hardware processors being further enabled to purge the code from the computing device if the code does not include the authentic digital signature.
19. The computing device of claim 17 , the one or more hardware processors being further enabled to denying the code access to the one or more APIs if the code does not include the authentic digital signature.
20. The computing device of claim 17 , wherein the one or more hardware processors being further enabled to, wherein controlling access by the code comprises:
granting the code access to the one or more APIs if the code includes the authentic digital signature.
21. The computing device of claim 17 , wherein the authentic digital signature corresponds to a plurality of APIs.
22. The computing device of claim 17 , wherein the code includes a plurality of digital signatures; and
wherein the plurality of digital signatures includes digital signatures corresponding to different APIs.
23. The computing device of claim 17 , wherein the code includes a plurality of digital signatures; and wherein the plurality of digital signatures includes digital signatures associated with different types of computing devices.
24. The computing device of claim 17 , wherein the code includes a plurality of digital signatures generated by a respective corresponding code signing authority.
25. The computing device of claim 24 , wherein each of the plurality of digital signatures was generated by its corresponding code signing authority by applying a respective private key associated with the code signing authority to a hash of the code.
26. The computing device of claim 17 , wherein the code signing authority includes any one or more of a manufacturer of the computing device, an author of the one or more APIs, a representative of the manufacturer of the computing device, or a representative of the author of the one or more APIs.
27. The computing device of claim 17 , wherein determining whether the code includes the authentic digital signature comprises:
generating a hash of the code to obtain a generated hash;
applying a public key to a digital signature included in the code to obtain a recovered hash, wherein the public key corresponds to a private key used to generate the digital signature; and
comparing the generated hash with the recovered hash.
28. The computing device of claim 17 , wherein determining whether the code includes the authentic digital signature comprises:
determining whether the code includes an authentic global signature.
29. The computing device of claim 17 , wherein the code comprises any of the following: a software application, an update to a software application, a command, a command argument, or a library.
30. The computing device of claim 17 , the one or more hardware processors being further enabled to display a message if the code attempts to access the one or more APIs.
31. The computing device of claim 17 , the one or more hardware processors being further enabled to receive a user command granting or denying the code access to the one or more APIs.
32. The computing device of claim 17 , wherein the one or more APIs are associated with one or more libraries, the one or more libraries including a public signature key used to determine whether the code includes the authentic digital signature, the computing device further comprising:
receiving, at a computing device, a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs), wherein the authentic digital signature is generated by a code signing authority external to the computing device, the code signing authority being an entity that issues authentic digital signatures; and
providing a digital signature to the requestor, the digital signature indicating authorization by a code signing authority for code of the requestor to access the one or more specific APIs.
33. One or more non-transitory computer readable memories comprising instructions that when executed by one or more processors of a computing device cause the one or more processors to perform instructions comprising:
determining whether the code includes an authentic digital signature of the code corresponding to one or more APIs of the computing device, wherein the authentic digital signature is generated by a code signing authority device external to the computing device, the code signing authority being an entity that issues authentic digital signatures; and,
controlling access by the code to the one or more APIs depending on whether the code includes the authentic digital signature.
34. The one or more non-transitory computer readable memories of claim 33 , wherein the instructions further comprise:
purging the code from the device if the code does not include the authentic digital signature.
35. The one or more non-transitory computer readable memories of claim 33 , wherein the instructions further comprise:
denying the code access to the one or more APIs if the code does not include the authentic digital signature.
36. The one or more non-transitory computer readable memories of claim 33 , wherein the instructions further comprise:
granting the code access to the one or more APIs if the code includes the authentic digital signature.
37. The one or more non-transitory computer readable memories of claim 33 , wherein the authentic digital signature corresponds to a plurality of APIs.
38. The one or more non-transitory computer readable memories of claim 33 , wherein the code includes a plurality of digital signatures; and wherein the plurality of digital signatures includes digital signatures corresponding to different APIs.
39. The one or more non-transitory computer readable memories of claim 33 , wherein the code includes a plurality of digital signatures; and wherein the plurality of digital signatures includes digital signatures associated with different types of devices.
40. The one or more non-transitory computer readable memories of claim 38 , wherein each of the plurality of digital signatures was generated by a respective corresponding code signing authority.
41. The one or more non-transitory computer readable memories of claim 40 , wherein each of the plurality of digital signatures was generated by its corresponding code signing authority by applying a respective private key associated with the code signing authority to a hash of the code.
42. The one or more non-transitory computer readable memories of claim 33 , wherein the code signing authority includes any one or more of a manufacturer of the device, an author of the one or more APIs, a representative of the manufacturer of the device, or a representative of the author of the one or more APIs.
43. The one or more non-transitory computer readable memories of claim 33 , wherein determining whether the code includes the authentic digital signature comprises:
generating a hash of the code to obtain a generated hash;
applying a public key to a digital signature included in the code to obtain a recovered hash, wherein the public key corresponds to a private key used to generate the digital signature; and
comparing the generated hash with the recovered hash.
44. The one or more non-transitory computer readable memories of claim 33 , wherein determining whether the code includes the authentic digital signature comprises:
determining whether the code includes an authentic global signature.
45. The one or more non-transitory computer readable memories of claim 33 , wherein the code comprises any of the following: a software application, an update to a software application, a command, a command argument, or a library.
46. The one or more non-transitory computer readable memories of claim 33 , further comprising:
displaying a message if the code attempts to access the one or more APIs.
47. The one or more non-transitory computer readable memories of claim 33 , wherein the instructions further comprise:
receiving a user command granting or denying the code access to the one or more APIs.
48. The one or more non-transitory computer readable memories of claim 33 , wherein the one or more APIs are associated with one or more libraries, the one or more libraries including a public signature key used to determine whether the code includes the authentic digital signature, wherein the instructions further comprise:
receiving, at a computing device, a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs); and
providing a digital signature to the requestor, the digital signature indicating authorization by a code signing authority for code of the requestor to access the one or more specific APIs.