Software Application Authentication via Developer Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional code signing certificate based authentication mechanisms are inadequate in protecting against malicious apps and rogue developers, as they rely on the integrity of code signing certificates, which can be compromised, and do not scale effectively for large user bases.
Innovation Solution
A method that selects a code signing certificate related to an application developer, generates an application developer identification from clean files signed with that certificate, and compares it with the signature of a software application to authenticate and control its installation and operation, using a database of trusted certificates, potentially employing machine learning and avoiding unnecessary scans if authentication is successful.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code signing certificate based authentication is used, then app authenticity can be verified, but security against malicious apps and rogue developers is insufficient
Solution Approach 1:
The patent introduces an intermediary verification mechanism where the app installer acts as a mediator between the code signing certificate verification and the actual app installation. The installer extracts developer identification data from the app, queries a remote server to verify this identification against the certificate holder's identity, and only permits installation if the identities match. This intermediary step prevents rogue developers from using stolen certificates to install malicious apps.
2Adaptability or versatility
If certificate based authentication is implemented, then app distribution flexibility is improved, but scalability to large user bases is compromised
Solution Approach 1:
The patent implements a self-service mechanism where each app installer on user devices autonomously performs the verification process by extracting developer identification data from installed apps, querying remote servers for verification, and making local decisions about app authenticity. This distributed self-service approach eliminates the need for centralized authentication servers to handle each verification request, enabling the system to scale to large user bases while maintaining flexible app distribution.
3Object-affected harmful factors
If antivirus scanning is performed on all apps, then security detection capability is improved, but computational load on devices increases
Solution Approach 1:
The patent performs preliminary authentication of apps through code signing certificate verification and developer identification matching before the app is installed or executed on the device. By verifying the app's authenticity in advance through the remote server query mechanism, the system can confidently skip or reduce intensive antivirus scanning for verified apps, thereby reducing computational load and energy consumption while maintaining security.
4Reliability
If multiple authentication mechanisms are employed, then security is improved, but system complexity increases
Solution Approach 1:
The patent merges the code signing certificate verification process with developer identification verification into a single integrated authentication flow within the app installer. Instead of treating these as separate authentication mechanisms, the system combines them by extracting developer identification data from the app, querying the remote server to verify the match between the certificate holder and the app's claimed developer, and making a unified authentication decision. This merging reduces system complexity while maintaining enhanced security.
Data Source
AI summary
A method of authenticating or controlling a software application on an end user device. The method includes selecting a code signing certificate related to an application developer; selecting one or more clean files from a database of known clean files signed with the selected code signing certificate; generating an application developer identification for the application developer on the basis of data extracted from the selected one or more clean files; adding the generated application developer identification to a database of trusted application developer certificates; comparing a signature related to a software application to be installed on an end user device with the application developer identification for authenticating said signature; and in the event that authentication is successful, performing authentication of the software application code and/or controlling installation and/or operation of the software application.