Host Package Registration for Unsigned Dynamic App Packages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in integrating dynamically created applications without signatures, which can lead to security concerns and delays in accessing system functions, especially when dynamically created content is generated by unsigned applications.
Innovation Solution
The use of a host package, which acts as a trusted gateway for registering and managing dynamically created client packages, ensuring they meet specific criteria and dependencies, while maintaining system security by limiting access to system functions and tracking their activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If unsigned client packages are registered with the operating system, then adaptability is improved by allowing dynamically created applications to run, but security is worsened due to potential malicious content
Solution Approach 1:
A host package acts as an intermediary between the operating system and unsigned client packages. The host package is signed and registered with the OS, providing a trusted gateway that enables the OS to accept and manage unsigned client packages through the host's verified identity, thus maintaining security while enabling adaptability
Solution Approach 2:
The system separates the trust verification function from the application execution function. The host package handles security verification and registration, while client packages handle dynamic application creation and execution. This segmentation allows unsigned applications to run without compromising system security
2Ease of operation
If unsigned client packages are allowed to access system functions, then ease of operation is improved by enabling application functionality, but security is worsened by potential unauthorized access
Solution Approach 1:
Each client package is granted access to specific system functions based on its requirements and the host package's permissions, rather than providing universal access. The access rights are localized to what is necessary for each application's functionality, minimizing security risks while maintaining operational ease
Solution Approach 2:
The system dynamically adjusts access parameters for each client package based on the host package's capabilities and the specific application needs. Access rights are modified and controlled through the host package's registered capabilities, enabling functionality while preventing unauthorized access
3Reliability
If the operating system verifies each dynamically created application, then security is improved by detecting malicious content, but productivity is worsened due to verification delays
Solution Approach 1:
The host package performs security verification and registration in advance before client packages need to execute. By pre-registering the host package with the operating system and establishing trust relationships beforehand, the system eliminates verification delays during application activation, maintaining both security and productivity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure concerns methods and systems for registering dynamically created packaged applications with an operating system. A dynamically created packaged application may not include a way to authenticate the packaged application but may declare a dependency on a host package. The host package may include a verified signature and be registered with the operating system. The host package may include a host runtime that references an executable included in the host package. The packaged application may not include executable files but may reference the host runtime. The operating system may register the packaged application based in part on its dependency on the host package. When the packaged application is activated, the packaged application may invoke the host runtime and the executable but do so with an application identity of the packaged application. The application identity may be different from a host runtime identity of the host runtime.