Multiple Source Evidence Trust Model for Application Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining the trustworthiness of software applications rely on single sources of trust, which are inadequate in verifying the legitimacy and integrity of applications, as they fail to consider multiple lines of evidence, leading to potential malicious software infections.
Innovation Solution
A multiple source evidence application trust model that evaluates applications based on a plurality of trust metrics, including digital signatures, trusted sources, previous download history, and reputation, using a weighted system to determine a trust level and allow or deny downloads based on a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single source of trust establishment is used, then the device complexity is reduced, but the reliability of application verification deteriorates
Solution Approach 1:
The trust model is segmented into multiple independent trust sources (developer trust, source trust, content trust, behavior trust) rather than relying on a single trust source. Each trust source evaluates different aspects of the application independently, and their results are combined to form a comprehensive trust assessment, thereby improving verification reliability while maintaining manageable complexity through modular design.
Solution Approach 2:
The patent creates a composite trust model that combines multiple types of trust evidence (developer information, source code verification, content analysis, behavior monitoring) into a unified trust assessment framework. This composite approach integrates diverse trust indicators to achieve more reliable application verification than any single trust source could provide alone.
2Measurement precision
If multiple trust metrics are evaluated, then the measurement precision of application trustworthiness is improved, but the productivity of application installation is reduced
Solution Approach 1:
The system performs partial trust metric evaluation by prioritizing critical trust sources and evaluating only the most relevant metrics for each application type and context. Not all trust metrics are evaluated to the same depth for every application, allowing the system to achieve sufficient measurement precision while reducing the time and resources required for trust assessment.
Solution Approach 2:
The patent implements preliminary trust assessment mechanisms that evaluate trust metrics in advance and cache results for future use. Trust information is pre-computed and stored, so that when an application installation is requested, the system can quickly retrieve pre-evaluated trust metrics rather than performing complete re-evaluation, thereby improving installation speed while maintaining measurement precision.
Data Source
AI summary
Disclosed are examples of authorizing an application access attempt. One example method may include connecting via a computing device to at least one remote computing device at a remote site and attempting to download an application from the remote site. The method may also include determining via a processor a trust level of the application based on trust metrics and comparing the trust level to a predetermined threshold. The method may also include determining whether to allow the application to be downloaded to the computing device based on results of the comparing operation.