Code Signing Service Key Management via Intermediary Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional code signing approaches burden organizations with the time and cost of securely storing and managing their own private keys, and controlling access to ensure authorized use.
Innovation Solution
A facility that generates and manages key pairs for software implementers, securely storing or regenerating private keys as needed, and publishing public keys, allowing implementers to outsource private key management and signing operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If organizations manage their own private keys, then they have full control over code signing, but they bear the time and cost burden of secure storage and access control
Solution Approach 1:
The patent introduces a third-party service provider as an intermediary that generates and manages private keys on behalf of organizations. This mediator handles the secure storage and access control of private keys, while organizations retain control through public key verification. This resolves the contradiction by transferring key management responsibilities to a specialized intermediary service.
Solution Approach 2:
The patent extracts the private key management function from the organization's infrastructure and relocates it to a dedicated key management service. By separating the key generation, storage, and management operations from the organization's systems, the patent eliminates the organizational burden of secure storage and access control while maintaining code signing capabilities.
2Reliability
If organizations manage their own private keys, then they maintain full control, but they incur costs for secure storage infrastructure
Solution Approach 1:
The third-party service provider acts as an intermediary that specializes in secure key management, absorbing the infrastructure costs. Organizations pay for the service rather than investing in expensive secure storage infrastructure, hardware security modules, and associated security personnel, thereby reducing overall costs while maintaining high security standards.
Solution Approach 2:
The patent enables organizations to use public keys as verifiable copies that can be freely distributed and stored without security concerns. This eliminates the need for expensive secure storage of private keys, as only the public key needs to be maintained and distributed for code verification purposes.
3Ease of operation
If organizations implement their own key management systems, then they have autonomy, but they increase device complexity
Solution Approach 1:
The patent extracts the complex key management infrastructure from the organization's operational environment and relocates it to an external service provider. This removes the complexity of secure key storage, access control policies, and key lifecycle management from the organization's systems, leaving only simple code signing and verification operations.
Solution Approach 2:
The key management service operates autonomously, generating and managing keys without requiring organizational intervention in security-critical operations. The service automatically handles key generation, storage, rotation, and revocation, eliminating the need for organizations to implement and maintain complex key management systems while preserving their ability to control code signing through public key verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A facility for enrolling a software implementer in a code signing. In one example facility, the facility receives information identifying the implementer, and credentials authenticating the implementer. The facility generates secret state for the implementer. Based on at least one or both of (1) at least a portion of the received credentials and (2) at least a portion of the generated secret state, the facility generates for the implementer a key pair comprising a private key and a public key, and persistently stores the secret state.