Signature Validation Database for Application Publisher Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for verifying digital signatures lack mechanisms to determine if a private key used for a digital signature is legitimately associated with the developer of an application, making it difficult to distinguish between legitimate and malicious applications, especially in the context of fraudulent websites and malicious developers.
Innovation Solution
A computer-implemented method and system for validating application signatures by maintaining a signature-validation database that associates application publishers with signature keys, identifying the key used to sign an application, determining if the application claims to be provided by a publisher, verifying the publisher's authenticity, and maintaining associations between publishers and keys to ensure legitimacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional digital signature verification systems are used, then signature verification can be performed, but the systems lack mechanisms to determine if a private key is legitimately associated with the developer, making them unable to distinguish between legitimate and malicious applications
Solution Approach 1:
The patent introduces a signature validation database as an intermediary component between the digital signature verification process and the application publisher. This database stores associations between signature keys and publisher identities, acting as a mediator that provides additional verification information without fundamentally changing the cryptographic verification process. The database serves as a trusted third party that links cryptographic keys to legitimate publishers, resolving the contradiction by adding reliability through an intermediary without requiring complete system redesign.
Solution Approach 2:
The system performs preliminary actions by pre-establishing associations between signature keys and publisher identities in the signature validation database before actual application verification occurs. During application verification, the system queries this pre-populated database to check if the signature key used by an application matches the expected key for its claimed publisher. This preliminary setup enables fast, reliable verification without adding complex real-time analysis during the verification process itself.
2Reliability
If digital signatures are used to verify application legitimacy, then users can ensure applications are from trusted developers, but fraudulent websites and malicious developers can still mimic legitimate applications if they obtain or compromise private keys
Solution Approach 1:
The patent implements feedback mechanisms where the signature validation database continuously stores and updates associations between signature keys and publisher identities. When an application is verified, the system queries this database to receive feedback on whether the signature key legitimately belongs to the claimed publisher. This feedback loop enables the system to detect impersonation attempts by comparing the application's claimed publisher identity against the trusted associations stored in the database, thereby reducing impersonation risk while maintaining application trustworthiness.
3Reliability
If comprehensive validation mechanisms are implemented to determine key legitimacy, then impersonation by malicious actors can be prevented, but the verification process becomes more complex and resource-intensive
Solution Approach 1:
The patent employs copying by creating and maintaining a database copy of trusted publisher-key associations that can be efficiently queried during verification. Instead of performing complex real-time analysis of publisher identities or cryptographic proofs, the system copies pre-validated associations into the signature validation database for fast lookup. This copying approach enables comprehensive validation of publisher-key associations while keeping the actual verification process simple and efficient, as it reduces to a straightforward database query rather than complex computational verification.
Data Source
AI summary
A computer-implemented method for validating application signatures may include maintaining a signature-validation database that associates application publishers with signature keys by, for each application in a set of applications, (1) identifying a key used to sign the application, (2) determining that the application claims to be provided by a publisher, (3) verifying that the claimed publisher provides the application, and (4) maintaining, in response to verifying that the claimed publisher provides the application, an association that indicates that the publisher of the application is authorized to use the key. Various other methods, systems, and computer-readable media are also disclosed.