Application Trust via Developer Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security mechanisms rely heavily on centralized certificates, which can be expensive and do not effectively convey trust based on the reputation of application developers, limiting the ability to trust software applications without manual verification.
Innovation Solution
A method where a trusted entity provides a digital signature and public key to validate the trustworthiness of an application or its developer, allowing users to trust applications based on the reputation of the developer, enabling viral trust propagation without relying on centralized authorities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized certificates are used to verify software trustworthiness, then software security is improved, but certification costs increase
Solution Approach 1:
The patent introduces a digital signature mechanism that acts as an intermediary between the application developer and the user. Instead of requiring expensive centralized certificates, the developer signs the application with their private key, and users verify the signature using the developer's public key. This intermediary signing mechanism establishes trust without requiring costly centralized certification authorities.
Solution Approach 2:
The patent enables trust to be copied and propagated through the distribution of public keys. Once a user verifies an application signature and trusts the developer, that trust relationship can be copied to future applications from the same developer by sharing the public key. This eliminates the need for repeated expensive certification for each application.
2Reliability
If centralized certificate authorities are used to validate applications, then trust verification is improved, but system complexity increases
Solution Approach 1:
The patent extracts the trust verification mechanism from the centralized certificate authority model and implements it locally in the user's browser or computing device. Instead of requiring users to connect to and verify certificates from centralized authorities, the verification logic and public keys are distributed to users, who can independently verify application signatures without complex centralized infrastructure.
Solution Approach 2:
Users perform their own trust verification by checking digital signatures locally using the developer's public key. This self-service approach eliminates the need for complex centralized verification systems, as each user becomes their own certificate authority, capable of independently validating application trustworthiness.
3Reliability
If manual verification of application trust is required, then security control is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements preliminary action by having developers sign applications with their private keys before distribution. This pre-established trust relationship is embedded in the application itself through the digital signature. When users receive the application, the trust verification is already prepared and can be automatically checked without requiring manual user intervention or research into the developer's credibility.
Data Source
AI summary
Systems, methods, and computer-program products enable a security system. Trust information is received, at a computer, where the trust information corresponds to an application and wherein the trust information comprising a digital signature from a trusted entity that is different than the developer of the application. A determination is made whether a user associated with the computer trusts the trusted entity. The digital signature is used to install the application on the computer if the user trusts the trusted entity.